Skip to main content
Fluxrate uses two authentication mechanisms depending on the context:
MechanismUsed ForHow
JWT CookiesDashboard & all management APIsaccess_token HttpOnly cookie
API KeysSDK usage tracking & widget tokensX-API-Key header

​
Login

curl -X POST https://api.fluxrate.co/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@yourcompany.com",
    "password": "your-password"
  }'
On success, Fluxrate sets two HttpOnly cookies:
  • access_token — Short-lived JWT (15 minutes by default)
  • refresh_token — Long-lived token (7 days by default)

​
Making Authenticated Requests

Browsers automatically send cookies. For programmatic access: 
curl -X GET https://api.fluxrate.co/api/v1/customers \
  -H "Cookie: access_token=eyJ..."

​
Refreshing the Access Token

When the access token expires, use the refresh token: 
curl -X POST https://api.fluxrate.co/api/v1/auth/refresh \
  -H "Cookie: refresh_token=abc123..."
Returns a new access_token cookie.

​
Logout

POST /api/v1/auth/logout
Clears both cookies.

​
Signup

curl -X POST https://api.fluxrate.co/api/v1/auth/signup \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@yourcompany.com",
    "password": "secure-password",
    "organization_name": "Acme Corp"
  }'

​
API Key Authentication

API keys are for server-to-server integration — primarily usage tracking from your backend.

​
Required Scope

EndpointRequired Scope
POST /sdk/trackusage.write
GET /usageusage.read
POST /widget/tokenusage.write

​
Usage

curl -X POST https://api.fluxrate.co/api/v1/sdk/track \
  -H "Content-Type: application/json" \
  -H "X-API-Key: org_live_abc123..." \
  -d '{
    "meter_token": "...",
    "customer_external_id": "cust_123",
    "quantity": 1
  }'

​
Managing API Keys

Create and manage API keys in Dashboard → API Keys or via the API: 
# Create
POST /api/v1/api-keys

# List
GET /api/v1/api-keys

# Delete
DELETE /api/v1/api-keys/<key_id>
API key secrets are shown only once at creation time. Store them securely in environment variables — never commit them to source code.