Authentication

API keys

Create keys in Settings → Integrations → Public API.

Prefix	Use
af_test_	Local and staging
af_live_	Production only

The full secret is shown once at creation. Store it in your server secrets manager or environment variables.

export AF_API_KEY="af_test_••••"

Request header

Authorization: Bearer af_test_••••

Alternate (equivalent):

X-AF-Api-Key: af_test_••••

Scopes

Keys are deny-by-default. Grant only what the integration needs.

Scope	Allows
products:read	List active products
fees:read	Coverage check + fee/turnaround preview
quotes:write	Create quotes (Open Quote queue). Does not accept quotes via API key.
quotes:read	Read public-safe quote status; lookup by id or external_reference
files:write	Upload documents to a quote/order
orders:write	Create draft orders (later wave)
orders:read	Read order milestones (later wave)
scheduling:read	Read booking options (later wave)
scheduling:write	Book/confirm inspection (later wave)
webhooks:manage	Register webhook endpoints via API (optional; UI always available)

Missing scope → 403 with insufficient_scope.

Invalid, revoked, or wrong-environment keys → 401 with invalid_api_key.

Who can create keys

Tenant users with company configuration permission (Owner / Company Admin). Keys are bound to the tenant, not to the creating user.

Rotation

1. Create a new key with the same scopes.
2. Deploy the new secret to your servers.
3. Revoke the old key.

Revocation is immediate.

IP allowlist (optional)

When configured on a key, requests from other IPs return 403 ip_not_allowed. Use for fixed server egress IPs. Skip for Zapier/serverless unless you know their ranges.

Sanity check

GET /public/v1/me
Authorization: Bearer af_test_••••

Returns tenant slug/name and the key’s scopes (never the secret).

Browser apps

Do not put API keys in frontend JavaScript, mobile apps, or public repos.

Pattern:

Browser form → Your backend → Appraiser Flow Public API

Your backend holds AF_API_KEY and enforces your own auth/CAPTCHA/rate limits for end users.