UFlow Cloud
GET-STARTED

Authentication

How API keys, OAuth 2.0, and permission scopes work.

To mint an API key head to Dashboard → your app → API Keys.

Bearer token

Every endpoint that requires authentication accepts your API key via the Authorization header: Authorization: Bearer uf_live_…. The plaintext key is shown exactly once at creation — save it immediately.

curl
curl https://cloud.uflow.uz/v1/me \
  -H "Authorization: Bearer uf_live_your_key_here"

Scopes

  • self:* / user:* / portfolio:* / session:read — UFlow ID: account, OAuth profile, portfolio
  • tools:invoke or granular tools:qr, tools:pdf, tools:image… — UFlow Tools (QR, PDF, image, JSON, search, icons, widgets)
  • eatly:read / eatly:write / eatly:foods / eatly:meals / eatly:ai — EatLy
  • notes:read / notes:write / notes:wall — notes.uflow.uz
  • chat:read / chat:send — chat.uflow.uz
  • contact:write — send messages to support

Security

Keys are never stored in plaintext — only a SHA-256 hash is persisted. Never embed a key in client-side code; use it from your server. If a key leaks, revoke it immediately in the Dashboard.

Errors

  • 401 — missing or invalid key
  • 403 — key lacks a required scope
  • 429 — rate limit exceeded