Overview
ChatinFlow supports two client authentication modes: Sanctum session cookies for the first-party web app, and personal access tokens (Bearer) for server-to-server or script access.
Both modes authorize against the same RBAC policies. Workspace context is required for tenant-scoped resources.
Choose a mode
Dashboard / SPA (cookies)
The Next.js app uses Sanctum CSRF + session cookies. Do not invent a second cookie scheme in custom frontends unless you also implement CSRF and same-site rules correctly.
Scripts and backends (PAT)
Create a PAT under Settings → Developers. Send `Authorization: Bearer <token>`. Prefer short-lived operational tokens and rotate when teammates leave.
Security notes
Heads up
No plaintext secrets in responses
Channel OAuth tokens and BYOK AI keys are envelope-encrypted server-side and never returned as plaintext in API responses.
Note
Token scopes and lifetime
Pick what a token may do when you create it: read, write, or a narrower contacts, inbox or automations read or write, and billing read. A token with no scope gets read. Tokens last 90 days unless you choose another lifetime, up to 366 days, and every request still runs with your role in the workspace.
Note
Workspace scope
Most resources are workspace-scoped. Ensure your token’s membership can access the workspace you target.
Was this guide helpful?
Browse more in the library
Ready to put this
into practice?
Start building your first automation for free. No credit card required. Just connect your channel and launch in minutes.