Skip to main content
Every call carries one credential in the Authorization header:
Never put a key or token in the URL. A request with api_key, key, access_token or token in the query string is refused with credentials_in_url. Revoke that key: URLs end up in logs.

​
API keys

For your own scripts, automations, and AI apps that can only send a header. A key acts as the person who created it. Revoke a key at any time in Settings; it stops working at once.
For an AI app that stores the key in its settings, use a key limited to one workspace, with only the permissions it needs and an expiry date.

​
Acting as a member (as_user)

An owner or admin can act as another member of the same workspace with an API key, by adding as_user=<user id> to the query. The call then reads and writes that member’s content, as View as does in the app. Every such call is recorded. It is refused with as_user_forbidden for anyone else, and is not available to connected apps or over MCP.

​
Connected apps (OAuth 2.1)

AI assistants (Claude, ChatGPT, Cursor…) and apps you build connect through CaptureFlow’s own OAuth 2.1 authorization server. The person signs in to CaptureFlow, sees what the app asks for, and can narrow it before approving.
  • Access tokens look like cfo_at_... and last one hour; apps refresh them.
  • Each token works only for the resource it was issued for: the REST API, the MCP server, or the read-only MCP server.
  • People see and disconnect their apps in Settings > API & MCP > Connected apps.
Building an app? See OAuth for app builders.

​
Who am I?

GET /v1/me returns the user a credential acts for, its type (api_key or oauth), its scopes and the workspace it is locked to, if any.

​
Errors