Authentication
Create an API key in the dashboard and authenticate requests with the x-api-key header.
Every API request is authenticated with your organization's API key, sent in the x-api-key header:
curl https://api.fileforms.com/v1/organization \
-H "x-api-key: sk_live_..."Keys are prefixed sk_live_ (production) or sk_test_ (the test environment). A missing or invalid key returns 401:
{ "message": "Unauthorized" }Create your API key
Your organization has one API key, created and managed in the dashboard — API keys can never be created or rotated via the API itself.
- In the dashboard, go to Settings → Developers. You need to be an organization admin.
- Click Create API Key.
- Copy the key and store it in your secrets manager. It is shown exactly once — the dashboard can never display it again, only the masked placeholder.
Billing setup required
Creating an API key requires billing to be set up first, because API orders are debited from your organization's prepaid balance. If billing isn't configured, the Developers tab shows a Set Up Billing button instead — see How billing works.
Rolling your key
Key rotation is a two-phase operation designed for zero-downtime cutover:
- Roll API Key — generates a new key. Both the old and new keys work from this moment.
- Update your integrations to the new key at your own pace.
- Complete Rotation — revokes the old key. Until you complete (or cancel) the rotation, the overlap window stays open indefinitely.
If a key leaks, roll it and complete the rotation immediately — completing is what revokes the compromised secret.
Key security
- Treat the key like a password: server-side only, never in client-side code, mobile apps, or version control.
- All requests must use HTTPS.
- The key acts on behalf of your whole organization. Every user, company, and order it touches is scoped to your organization — one partner can never read another's data.