Create and manage API tokens

An API token is a long secret string that authenticates an external client (Zapier, Make, your own tool) with Flino. Each token has a single fixed scope: offer_import:write — i.e. “create offers”. You manage your tokens yourself — there are no roles or approvals; the account owner creates tokens, sees them, and revokes them.

Where to find tokens

Settings → Integrations tab → API tokens section.

Subtitle: “Create tokens for external integrations like Zapier or Zoho CRM. The plaintext token is shown only once after creation.”

![Screenshot: API tokens section with the list of active tokens](TODO)

Create a token

1. Click New token.
2. Give it a name — something that helps you recognise its purpose later, e.g. “Zoho CRM production”.
3. Click Create token.

You now see the modal Token created with the plaintext token.

Important: the plaintext is shown only once. Copy it immediately via the Copy button and store it in your password manager or directly in the external system. After you close the modal, you cannot retrieve the token — you would have to create a new one.

Token list

In the overview you see:

• Token name
• Scope badge — currently always offer_import:write
• Created: date
• Last used: date (or ”—” if never used)

Revoke a token

If a token is compromised or no longer needed:

1. Click the trash icon Revoke token on the right.
2. Confirmation dialog Revoke token? with the token name.
3. Click Revoke token in the dialog.

Toast: “Token revoked”. The token moves to the Revoked tokens section — every request with the old token is now rejected with 401 Token has been revoked.

Revoked tokens cannot be reactivated. Create a new token if needed.

Webhook URL

In the same area you find the URL where to send requests (the “Zapier Webhook URL” section). The URL has the form:

https://<your-project>.supabase.co/functions/v1/zapier-offer-import

Flino shows the <your-project> part directly in the UI. This address is canonical and permanent — a separate API subdomain is not planned.

Security notes

• Never commit the token publicly or store it in a repository.
• Only send it over HTTPS.
• Header: x-flino-token: <your-token> — see Webhook endpoint.
• On staff change, revoke and re-issue.
• One token per tool so you can revoke them independently.