Authentication
All Public API requests require API key authentication.
API key location
Create and revoke API keys in the Floatless product console under Developers -> API Keys.
API keys
Floatless API keys are server-side credentials. A generated key is shown only once.
Current keys use the sk_live_ prefix followed by 32 alphanumeric characters. Keys can carry an optional expiration date; expired keys fail with UNAUTHORIZED like revoked ones. Floatless stores only a bcrypt hash and a short prefix for display — the full secret is never recoverable, so rotation follows the pattern create new key → deploy it → revoke the old one. There is no in-place rotation.
Keys can also be created from the Public API-independent console; both surfaces manage the same keys.
Authorization header
Include your API key in the Authorization header:
Authorization: Bearer sk_live_...
Example request
curl https://api.floatless.com/api/public/v1/customers \
-H "Authorization: Bearer sk_live_..." \
-H "Accept: application/json"
Security requirements
- Never expose API keys in browser code, mobile apps, public repositories, screenshots, or customer-facing logs.
- Store keys in a server-side secret manager or environment variable.
- Rotate keys when team members leave or infrastructure changes.
- Revoke keys that are no longer used.
- Use different keys for separate services when possible.
Missing or invalid keys
Missing, malformed, revoked, or expired keys return 401 with the error envelope (see Errors & request IDs). Malformed headers — anything other than Bearer <key> — also return 401 with a message naming the expected format. All 401 responses include WWW-Authenticate: Bearer.
| Code | Meaning |
|---|---|
| 401 | Invalid or missing API key |
| 403 | Authenticated, but not allowed to perform the action |
| 429 | Request rate exceeded (includes a Retry-After header) |