API authentication

Select the authentication method for the surface you are calling.

Server-side data requests

Issue a project token through Dashboard and keep it in a server environment variable. For example, this read-only request checks that GraphQL accepts the credential without depending on a particular entity schema:

curl "https://${FLEXKIT_PROJECT_ID}.api.flexkit.io/graphql"   -H "Authorization: Bearer ${FLEXKIT_API_TOKEN}"   -H "Content-Type: application/json"   --data '{"query":"query CheckConnection { __typename }"}'

Set FLEXKIT_PROJECT_ID and FLEXKIT_API_TOKEN in your trusted shell environment first. Do not paste tokens into public repositories, browser bundles, screenshots, or issue reports.

Studio and MCP

Studio’s adapter handles the signed-in session and same-origin proxy. Use the documented framework setup rather than copying browser cookies into integration scripts. MCP uses OAuth and the consenting user’s project authority.

Custom tools use signed requests with a separate server secret. An API token is not a substitute for the tool signing secret.

Diagnose failures

Check the project ID, credential type, revocation, project role, spaces, and service restrictions. Distinguish an authentication failure from a denied operation and a browser CORS failure. Inspect GraphQL errors even if the HTTP request succeeds.