---
title: Authentication
slug: authentication
createdAt: 2026-11-02T08:43:16.731Z
---

## Legacy CustomerArea — X-API-KEY

Every legacy call must carry the API key in the <font color="#EF4444">`X-API-KEY`</font> header:

```curl
curl 'https://api.fsflt.net/customerarea/customers/list' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'X-API-KEY: YOUR_LEGACY_API_KEY'
```

Notes:

- The key is generated in the **legacy** customer area under *Integrations > API*.
- Keys are bound to the admin user and inherit its role (dealer, distributor, reseller…). Several operations are only permitted to specific roles — see the <font color="#EF4444">`406`</font> / <font color="#EF4444">`428`</font>errors in section 3.2.
- Responses are wrapped in an envelope. **The&#x20;**<font color="#EF4444">`code` </font>**field inside the body is the authoritative result**, and it does not always match the HTTP status:

```json
{
  "code": 200,
  "content": { "customer_code": 12345 }
}
```

## Cloud Panel 2026 — API key or JWT

Two equivalent methods:

- **API key (recommended for server-to-server integrations)**

```curl
curl 'https://core.fsflt.net/organization/v1' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'
```

The key is shown in the new panel under *Integrations > API*, and is also returned by the login endpoint as user.apiKey.value.

- **JWT bearer token (used by the web panel)**

```curl
curl -X POST 'https://core.fsflt.net/authentication/v1/login' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "admin@example.com",
    "password": "your-password"
  }'
```

```json
{
  "accessToken": "eyJhbGciOi...",
  "accessTokenExpiresAt": 1760517667060,
  "refreshToken": "eyJhbGciOi...",
  "refreshTokenExpiresAt": 1760520367060,
  "user": {
    "apiKey": {
      "id": "0199e6ca-2ace-7af3-955c-c21629c90214",
      "value": "0199e6ca-2acd-7499-ac52-097896c6a5c7"
    },
    "id": "0199e6ca-2ad4-7b00-b103-b1a62f87d35c",
    "name": "John Due",
    "organizationId": "0199e6ca-2ae0-7ba1-bab9-a12c5f8ca1c7",
    "role": { "id": "0199e375-e27a-7a82-8b8e-84706f381512", "name": "ADMIN" },
    "username": "admin@example.com"
  }
}
```

Then:

```curl
curl 'https://core.fsflt.net/protection/v1/policies' \
  -H 'Authorization: Bearer eyJhbGciOi...'
```

Refresh and logout:

| **Method**                          | **Endpoint**                                              | **Notes**                                          |
| ----------------------------------- | --------------------------------------------------------- | -------------------------------------------------- |
| <font color="#EF4444">`POST`</font> | <font color="#EF4444">`/authentication/v1/refresh`</font> | Exchanges the refresh token for a new access token |
| <font color="#EF4444">`POST`</font> | <font color="#EF4444">`/authentication/v1/logout`</font>  | Invalidates the current session                    |
| <font color="#EF4444">`GET`</font>  | <font color="#EF4444">`/authentication/v1/me`</font>      | Current user and organization                      |

:::hint{type="info"}
**Credential hygiene:** JWTs and API keys grant full access to the organization configuration. Keep them server-side, never in browser bundles or mobile apps, and rotate them if exposed.
:::

## Organization context (organizationId)

Nearly every Cloud API route accepts an <font color="#EF4444">`organizationId`</font> parameter that selects **which organization the operation applies to**. It is not repeated in each endpoint's parameter list because it is universally supported:

| **Method**                                                                                                        | **Where to pass&#x20;**<font color="#EF4444">`organizationId`</font> | **Effect**                                             |
| ----------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------ |
| <font color="#EF4444">`GET`</font>                                                                                | Query string (<font color="#EF4444">?</font>)                        | Read data from that organization                       |
| <font color="#EF4444">`POST`</font> / <font color="#EF4444">`PATCH`</font>/ <font color="#EF4444">`DELETE`</font> | Request body                                                         | Create or modify entities **inside** that organization |

If omitted, the API falls back to the organization of the authenticated user.

```curl
# Read the policies of a specific tenant
curl 'https://core.fsflt.net/protection/v1/policies?organizationId=0199e6ca-2ae0-7ba1-bab9-a12c5f8ca1c7' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'

# Create a policy inside that same tenant
curl -X POST 'https://core.fsflt.net/protection/v1/policies' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Guest Policy",
    "organizationId": "0199e6ca-2ae0-7ba1-bab9-a12c5f8ca1c7",
    "isLimited": false,
    "isShared": false
  }'
```