Create and manage API tokens

An API token is a long secret string that authenticates an external client (Zapier, Make, your own tool) with Flino. Each token has a single fixed scope: offer_import:write — i.e. “create offers”.

Tokens belong to your organisation, not to an individual person. Only owners and admins of the organisation can create, view, and revoke them; normally that is you, because every person is the owner of their own workspace. Anyone without that role sees this note instead of the list: “API tokens can only be managed by organisation admins. Contact your admin to set up an integration.”

Do not confuse: the API tokens here apply to the offer import via webhook. For your AI assistant there are separate access tokens in the AI assistant access (MCP) card, described under Connect your AI assistant.

Where to find tokens

Settings → Integrations → API tokens card.

Subtitle: “Create tokens for external integrations like Zapier or Zoho CRM. The plain-text token is shown only once after creation.”

Create a token

1. Click New token.
2. In the New API token dialog, enter a name under Token name that helps you recognise its purpose later, e.g. “Zoho CRM Production”.
3. Click Create token.

You now see the modal Token created with the plaintext token.

Important: the plaintext is shown only once. Copy it immediately via the Copy button and store it in your password manager or directly in the external system. After you close the modal with Done, you cannot retrieve the token and would have to create a new one.

Token list

For each token the overview shows:

• Token name
• Scope badge — currently always offer_import:write
• Created: date
• Last used: date (or ”—” if never used)

Revoke a token

If a token is compromised or no longer needed:

1. Click the trash icon Revoke token on the right.
2. The confirmation dialog Revoke token? opens with the token name.
3. Click Revoke.

Toast: “Token revoked”. The token then appears under Revoked tokens with the Revoked badge. Every request with the old token is now rejected with 401 Token has been revoked.

Revoked tokens cannot be reactivated. Create a new token if needed.

Webhook URL

In the same card, under “Zapier webhook URL”, you find the address to send requests to. The URL has the form:

https://<your-project>.supabase.co/functions/v1/zapier-offer-import

Flino shows you the full URL directly. Below it you see the note: “Send a POST with Content-Type: application/json and the header x-flino-token: <your-token>. No additional Authorization header is required.”

This address is canonical and permanent — a separate API subdomain is not planned.

Security notes

• Never commit the token publicly or store it in a repository.
• Only send it over HTTPS.
• Header: x-flino-token: <your-token> — see Webhook endpoint.
• On staff change, revoke and re-issue.
• One token per tool so you can revoke them independently. Each token also has its own limit of 60 requests per minute.