Authentication
Sanctum session cookies for the web app and personal access tokens for scripts.
ChatinFlow Team
Official guide
Overview
ChatinFlow supports two client authentication modes: Sanctum session cookies for the first-party web app, and personal access tokens (Bearer) for server-to-server or script access.
Both modes authorize against the same RBAC policies. Workspace context is required for tenant-scoped resources.
Choose a mode
Dashboard / SPA (cookies)
The Next.js app uses Sanctum CSRF + session cookies. Do not invent a second cookie scheme in custom frontends unless you also implement CSRF and same-site rules correctly.
Scripts and backends (PAT)
Create a PAT under Settings → Developers. Send `Authorization: Bearer <token>`. Prefer short-lived operational tokens and rotate when teammates leave.
Security notes
Heads up
No plaintext secrets in responses
Channel OAuth tokens and BYOK AI keys are envelope-encrypted server-side and never returned as plaintext in API responses.
Note
Workspace scope
Most resources are workspace-scoped. Ensure your token’s membership can access the workspace you target.
Was this guide helpful?
Browse more in the library
Ready to put this
into practice?
Start building your first automation for free. No credit card required. Just connect your channel and launch in minutes.