Skip to main content

Authentication

Re:port Flow API supports two authentication methods: appkey header authentication and OAuth 2.0 / OpenID Connect. Choose the one that fits your use case.

Should I use appkey or OAuth?​

If you are automating a single workspace of your own, the appkey header is enough. Reach for OAuth 2.0 when an external service or another user has to authorise access. When in doubt, find the closest row in the "Use case" column below.

Use caseRecommended method
Single-workspace automation (cURL, internal batch jobs)appkey header
Server-to-server integration (backend → Re:port Flow)OAuth 2.0 Client Credentials
Per-user authorization (Make.com, third-party SaaS, personal apps)OAuth 2.0 Authorization Code + PKCE

See OAuth 2.0 Authentication for the OAuth flows. This page covers the appkey method.

appkey method​

Send the appkey header (lowercase) on every request:

appkey: your-application-key

API endpoint​

Base URL: https://api.re-port-flow.com/v1

Examples:

  • Single PDF generation: https://api.re-port-flow.com/v1/file/sync/single
  • Design parameters: https://api.re-port-flow.com/v1/file/design/parameter/{designId}

What do the authentication errors mean?​

appkey authentication fails with one of two status codes. A 412 means the appkey header was not sent at all; a 401 means it was sent but the value is wrong. Check which one you got before digging further. (OAuth 2.0 failures come back as RFC 6749 codes such as invalid_client instead — see Error responses.)

If authentication fails, the following errors are returned:

401 Unauthorized​

{
  "statusCode": 401,
  "message": "認証情報が不正です",
  "error": "Unauthorized"
}

(The server returns the message in Japanese; it translates to "Invalid credentials".)

Cause:

  • The appkey header is invalid or has been revoked

412 Precondition Failed​

{
  "statusCode": 412,
  "message": "認証方式ヘッダーが存在しません",
  "error": "Precondition Failed"
}

(The server returns the message in Japanese; it translates to "Authentication header is missing".)

Cause:

  • The appkey header is missing

Security Best Practices​

1. Secure API Key Storage​

// ❌ Bad: Hardcoded in source code
const APP_KEY = 'hardcoded-key';

// ✅ Good: Use environment variables
const APP_KEY = process.env.REPORT_FLOW_APP_KEY;

2. Use HTTPS​

All API requests must use HTTPS. HTTP requests are not accepted.

3. Key Rotation​

Regularly regenerate API keys and invalidate old keys.

4. Scope Limitation​

Use different API keys for production and development environments to separate access.

Sample Code​

cURL​

curl -X POST https://api.re-port-flow.com/v1/file/sync/single \
  -H "appkey: your-application-key" \
  -H "Content-Type: application/json" \
  -d '{...}'

JavaScript​

const headers = {
  'appkey': process.env.REPORT_FLOW_APP_KEY,
  'Content-Type': 'application/json'
};

Python​

import os

headers = {
    'appkey': os.environ['REPORT_FLOW_APP_KEY'],
    'Content-Type': 'application/json'
}

OAuth 2.0 Authentication​

For server-to-server integrations or per-user authorization, use OAuth 2.0 instead of appkey.

  • Authorization Code + PKCE: User authorization flow for Make.com, custom apps, etc.
  • Client Credentials: Server-to-server integration from your backend to Re:port Flow

See OAuth 2.0 Authentication for details.

Next Steps​