Authentication
Create API keys, choose what they can do, set an expiry, revoke them, and connect apps with OAuth.
Every call to the REST API and the MCP server carries a credential in the Authorization header:
Authorization: Bearer skf_…You can use an API key (made in SKUFlow, starts with skf_) or, for AI apps that support it, an
OAuth connection where you sign in with SKUFlow and approve the app. Both act as you, in one
business, and never do more than your role allows.
API keys
Owners and admins manage keys in Settings → Developers, under API keys.
Create a key
Open the API keys
Go to Settings → Developers and click Create API key.
The Create an API key dialog
Screenshot coming soon
Name it
Give it a Name that says what uses it, like "Zapier" or "Our website". Make one key per integration, so the activity log shows what each one did and you can revoke one without breaking the others.
Choose the access level
| Access | What the key can do | OAuth scopes |
|---|---|---|
| Read only | See records. Can't change anything. | skuflow.read |
| Read and write | Also create and edit records. Nothing is sent to customers and no money moves. | skuflow.read, skuflow.write |
| Full access | Also money, deletes, messages to customers and access changes. Only give this to software you trust. | skuflow.read, skuflow.write, skuflow.sensitive |
Every endpoint in the API reference shows its risk class (read,
write or sensitive), which is the scope it needs.
Choose permissions
Leave Everything my role can do, or pick Choose permissions and tick only what this
integration needs (for example customers.read and quotes.write). You can only pick permissions
your own role has.
Set an expiry
Under Expires, choose In 30 days, In 90 days, In 1 year or Never. The key stops working at the start of its expiry day (UTC).
Copy the key
Click Create key. Click Copy key, store it somewhere safe, like a password manager, then click I've saved it.
The key is shown only once. SKUFlow keeps only a fingerprint of it, so nobody (including SKUFlow support) can show it to you again. If you lose it, revoke it and make a new one.
What a key can do
A key's rights are the overlap of three things:
- The role of the person who made it, as it is today. If their role is lowered, the key loses what the role lost. If they leave the business, the key stops working.
- The key's permissions (everything the role can do, or the ones you picked).
- The key's access level (its scopes). A sensitive call always needs Full access: it is never implied by the others.
A call outside those rights answers 403 with a message that names the missing permission or scope.
A key works only in the business it was made in. You can have up to 50 active keys per business.
What a key can never do
Some things need a person signed in to SKUFlow, whatever the key's access:
- Make, list or revoke API keys, or approve an AI assistant's request.
- Change your own profile, notifications or the list of businesses you belong to.
- Use SKUFlow AI, the in-app assistant (call the API directly instead).
- Buy AI credits or add-ons, or open the billing portal.
- Finish connecting an outside account (QuickBooks, Xero, Google, ad platforms): the key can start the connection, and you finish it in your browser.
These answer 403. A few other actions (inviting people, changing roles, adding webhooks, connecting
accounts, payout and plan changes) work with a key but wait for your approval first. See
Approvals.
See what a key did
Everything a key changes, and every call it was refused, is in Settings → Activity log (owners and admins), shown as an API key acting for the person who made it. Filter by Channel to see only API calls. The keys list shows when each key was Last used.
Revoke a key
In Settings → Developers, under API keys, click Revoke next to the key, then Revoke
key. Anything using it stops working on its next call (401). This can't be undone; the key stays
in the list as Revoked so the activity log can still name it.
Connected apps (OAuth)
AI apps such as ChatGPT and Claude can connect by having you sign in with SKUFlow instead of pasting a key. You choose the business the app may act in and approve the scopes it asks for. The app then acts as you, with your current role, limited to those scopes.
- Settings → Developers says whether sign-in with SKUFlow is switched on for your account. Until it is, connect with an API key.
- See and disconnect the apps you approved under Apps you connected in Settings → Developers. Disconnecting is immediate.
- Apps act in one business: the one you picked when you approved them.
- OAuth discovery for MCP clients is at
https://app.skuflow.ai/.well-known/oauth-protected-resource/api/mcp, and every unauthenticated MCP answer carries aWWW-Authenticateheader pointing to it.
See Connect an AI assistant for step-by-step setup in each app.
Keep keys safe
- Never put a key in a web page, a mobile app or a public repository. Call SKUFlow from your server.
- Give each integration the lowest access level that works. Most reporting needs only Read only.
- Set an expiry on keys used for one-off jobs.
- If a key may have leaked, revoke it straight away and make a new one.