Authentication

API Keys

API keys authenticate requests made from your backend, scripts, or tools like Postman. Every key starts with flyn_sk_live_ followed by 64 hex characters and is SHA-256 hashed at rest, we never store the plaintext value.

How to create an API key

1. Sign in to the Flyn dashboard.
2. Open Settings → API (or go directly to /settings?tab=api).
3. Click Generate New Key and give it a descriptive name (e.g. "Production server", "Local dev").
4. Copy the full key shown in the modal, it's the only time the plaintext value is visible.
5. Store it in your environment variables, secrets manager, or a password vault.

Where to find your API keys

Open Settings → API in the dashboard. You'll see every key you've ever created with the following details:

• Name, the label you chose at creation
• Prefix, first 8 characters of the key for identification
• Created, when the key was generated
• Last used, most recent authenticated request with this key
• Status, active or revoked

For security reasons, the full plaintext key is never displayed again after creation. If you've lost a key, revoke it and generate a new one.

How to revoke an API key

1. Open Settings → API in the dashboard.
2. Find the key you want to revoke in the list.
3. Click the Revoke button next to it.
4. Confirm the action in the dialog.

Revocation takes effect immediately. Any subsequent request using that key will return 401 Unauthorized. Revoked keys cannot be reactivated, you'll need to generate a new one if you want to restore access.

Using your API key

Include your API key in the Authorization header of every request, prefixed with Bearer:

Authorization: Bearer flyn_sk_live_a1b2c3d4e5f6...

Base URL

All API requests should be made to:

https://www.flyn.to

Example request

Create a new short link with a Bearer token:

curl https://www.flyn.to/api/links \
  -X POST \
  -H "Authorization: Bearer flyn_sk_live_xxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com",
    "slug": "my-link"
  }'

Using the SDK

The official Flyn SDK handles authentication automatically when you pass your key during initialization:

import { Flyn } from 'flyn-sdk';

const flyn = new Flyn({
  apiKey: process.env.FLYN_API_KEY!,
});

const link = await flyn.links.create({
  url: 'https://example.com',
});

console.log(link.shortUrl);

Common authentication errors

Session authentication (dashboard only)

A handful of internal endpoints, including /api/account/* (data export, deletion, role), /api/teams/*, and /api/auth/* (MFA, sessions), are reserved for the Flyn dashboard and rely on cookie-based session authentication. The public API surface (links, clicks, domains, webhooks, keys, deep links, shorten) accepts Bearer tokens.

• They rely on browser login sessions (cookies)
• They are not accessible with API keys
• They should not be used from Postman, cURL, or any backend integration
• Calling them with only a Bearer token returns 401 Unauthorized

Best practices

• Store API keys in environment variables (e.g. .env) or a secrets manager
• Rotate keys periodically, generate a new one, deploy it, then revoke the old key
• Use separate keys for development and production environments
• Never commit keys to source control or expose them in client-side code
• If a key is leaked, revoke it immediately and rotate to a new one
• Set an expiration date on keys you only need temporarily