Overview

The public API serves workflow payloads to embeds and to anything else that wants them. It has one operation today: GET /api/v1/workflows/:id.

https://fluorite.studio/api/v1

Capability URLs

The endpoint is public and unauthenticated: the workflow id is the capability. Anyone holding an id can fetch that workflow's payload — that is what lets an embed on a third-party site render it. Treat workflow ids like unlisted URLs.

CORS is open (Access-Control-Allow-Origin: *), so browsers can call the API from any origin.

Optional bearer tokens

Requests may carry a bearer token. Tokens authenticate the caller and record use, but the operation stays public — a valid token is never required.

Authorization: Bearer flr_…

Two kinds exist, both shown once at creation and stored hashed:

• Personal tokens (flr_…) — minted at /settings/tokens.
• Org API keys (flr_org_…) — minted at the org's API keys settings page (admin only).

Conditional requests

Every payload response carries an ETag derived from the workflow's updatedAt. Send it back as If-None-Match and an unchanged workflow returns a bodyless 304 — this is how embed polling stays cheap.

Cache-Control: public, max-age=0, must-revalidate