Authentication

7 min

Legacy CustomerArea — X-API-KEY

Every legacy call must carry the API key in the X-API-KEY header:

curl 'https://api.fsflt.net/customerarea/customers/list' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'X-API-KEY: YOUR_LEGACY_API_KEY'

Notes:

The key is generated in the legacy customer area under Integrations > API.

Keys are bound to the admin user and inherit its role (dealer, distributor, reseller…). Several operations are only permitted to specific roles — see the 406 / 428errors in section 3.2.

Responses are wrapped in an envelope. The code field inside the body is the authoritative result, and it does not always match the HTTP status:

{
  "code": 200,
  "content": { "customer_code": 12345 }
}

Cloud Panel 2026 — API key or JWT

Two equivalent methods:

API key (recommended for server-to-server integrations)

curl 'https://core.fsflt.net/organization/v1' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'

The key is shown in the new panel under Integrations > API, and is also returned by the login endpoint as user.apiKey.value.

JWT bearer token (used by the web panel)

curl -X POST 'https://core.fsflt.net/authentication/v1/login' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "[email protected]",
    "password": "your-password"
  }'

{
  "accessToken": "eyJhbGciOi...",
  "accessTokenExpiresAt": 1760517667060,
  "refreshToken": "eyJhbGciOi...",
  "refreshTokenExpiresAt": 1760520367060,
  "user": {
    "apiKey": {
      "id": "0199e6ca-2ace-7af3-955c-c21629c90214",
      "value": "0199e6ca-2acd-7499-ac52-097896c6a5c7"
    },
    "id": "0199e6ca-2ad4-7b00-b103-b1a62f87d35c",
    "name": "John Due",
    "organizationId": "0199e6ca-2ae0-7ba1-bab9-a12c5f8ca1c7",
    "role": { "id": "0199e375-e27a-7a82-8b8e-84706f381512", "name": "ADMIN" },
    "username": "[email protected]"
  }
}

Then:

curl 'https://core.fsflt.net/protection/v1/policies' \
  -H 'Authorization: Bearer eyJhbGciOi...'

Refresh and logout:

Method	Endpoint	Notes
POST	/authentication/v1/refresh	Exchanges the refresh token for a new access token
POST	/authentication/v1/logout	Invalidates the current session
GET	/authentication/v1/me	Current user and organization

Credential hygiene: JWTs and API keys grant full access to the organization configuration. Keep them server-side, never in browser bundles or mobile apps, and rotate them if exposed.

Organization context (organizationId)

Nearly every Cloud API route accepts an organizationId parameter that selects which organization the operation applies to. It is not repeated in each endpoint's parameter list because it is universally supported:

Method	Where to pass organizationId	Effect
GET	Query string (?organizationId=...)	Read data from that organization
POST / PATCH/ DELETE	Request body	Create or modify entities inside that organization

If omitted, the API falls back to the organization of the authenticated user.

# Read the policies of a specific tenant
curl 'https://core.fsflt.net/protection/v1/policies?organizationId=0199e6ca-2ae0-7ba1-bab9-a12c5f8ca1c7' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'

# Create a policy inside that same tenant
curl -X POST 'https://core.fsflt.net/protection/v1/policies' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Guest Policy",
    "organizationId": "0199e6ca-2ae0-7ba1-bab9-a12c5f8ca1c7",
    "isLimited": false,
    "isShared": false
  }'