Authentication

API Keys

GhostFlow uses API keys prefixed with gf_ for programmatic access. Keys are passed via the Authorization header using the Bearer scheme:

Authorization: Bearer gf_abc123def456...

Creating API Keys

Generate keys from the Settings → API Keys page in your dashboard, or programmatically:

curl -X POST https://devcore.getghostflow.io/api/v1/auth/api-keys \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production Key",
    "permissions": ["read:campaigns", "write:campaigns", "read:stats"]
  }'

Caution

The full API key is only shown once at creation time. Store it securely — you cannot retrieve it later.

Permissions (Scopes)

Each API key can be scoped to specific permissions. Scopes follow the action:resource pattern:

Scope	Description
read:campaigns	List and view campaigns
write:campaigns	Create, update, delete campaigns
read:domains	List and view domains
write:domains	Create, update, delete domains
read:offers	List and view offers
write:offers	Create, update, delete offers
read:sources	List and view traffic sources
write:sources	Create, update, delete sources
read:networks	List and view affiliate networks
write:networks	Create, update, delete networks
read:stats	Access statistics and reports
read:billing	View subscription and billing info
admin	Full administrative access

Legacy permissions (read, write, admin) are still supported and automatically expanded:

• read → all read:* scopes
• write → all read:* + write:* scopes
• admin → all scopes

Key Management

Action	Endpoint	Method
List keys	/api/v1/auth/api-keys	GET
Create key	/api/v1/auth/api-keys	POST
Delete key	/api/v1/auth/api-keys/{id}	DELETE
Revoke key	/api/v1/auth/api-keys/{id}/revoke	PUT
Regenerate key	/api/v1/auth/api-keys/{id}/regenerate	POST
Audit log	/api/v1/auth/api-keys/{id}/audit-log	GET

Security Best Practices

1. Use least-privilege scopes — Only grant the permissions each integration needs
2. Rotate keys regularly — Use the regenerate endpoint to get a new secret
3. Never commit keys — Use environment variables or secret managers
4. Monitor usage — Check the audit log for unexpected API activity
5. Revoke compromised keys immediately — Revoking is instant and cannot be undone

JWT Tokens

For browser-based access (dashboard), GhostFlow uses short-lived JWT access tokens with refresh token rotation. API keys are preferred for server-to-server integrations.