Authentication
All Public API requests require API key authentication.
API key location
Create and revoke API keys in the Floatless product console under Developers -> API Keys.
API keys
Floatless API keys are server-side credentials. A generated key is shown only once.
Current keys use the sk_live_ prefix in local and production environments.
Authorization header
Include your API key in the Authorization header:
Authorization: Bearer sk_live_...
Example request
curl https://api.floatless.com/api/public/v1/customers \
-H "Authorization: Bearer sk_live_..." \
-H "Accept: application/json"
Security requirements
- Never expose API keys in browser code, mobile apps, public repositories, screenshots, or customer-facing logs.
- Store keys in a server-side secret manager or environment variable.
- Rotate keys when team members leave or infrastructure changes.
- Revoke keys that are no longer used.
- Use different keys for separate services when possible.
Missing or invalid keys
Missing, malformed, revoked, or expired keys return:
{
"error_code": "UNAUTHORIZED",
"detail": "Invalid or expired API key",
"details": null,
"request_id": "req_..."
}
| Code | Meaning |
|---|---|
| 401 | Invalid or missing API key |
| 403 | Authenticated, but not allowed to perform the action |
| 429 | Request rate exceeded |