Authentication

Authenticate to the Flax API with service-account tokens (flax_pat_…) carrying read and write scopes

Programmatic access to the Flax API uses API tokens held by service accounts. A service account is a non-human principal you assign to teams so it can see the data you want; a token is the secret it authenticates with. This page is for developers wiring up scripts, jobs, or MCP clients.

#Service accounts and tokens

  • Create a service account, then issue one or more tokens for it on the API access page at /app/settings/api.
  • A token secret looks like flax_pat_… and is shown once at creation — store it securely.
  • Assign the service account to teams so it inherits the data access you intend. A token never grants more than its service account can see.

#Scopes

Each token carries one or both scopes:

Scope Grants
read List and read models, connections, charts, dashboards, and run queries
write Create and update charts, sheets, and dashboards

Pick the narrowest scope that fits the job. A read-only automation should never hold a write token.

#Making a request

Send the token in the Authorization header as a bearer credential:

curl https://flax.example.com/api/projects \
  -H "Authorization: Bearer flax_pat_xxx"

Every request is additionally constrained by the service account's team membership and row-level security — the token adds no privilege of its own.

Warning

Treat flax_pat_… tokens like passwords. Keep them out of source control and rotate them by revoking and reissuing on the API access page.

#Next steps