Authentication

A secret API key, as a bearer token, from your server only.

cURL

curl https://app.concatflow.com/api/v1/embed/sessions \
  -H "Authorization: Bearer $CONCATFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "assistant_id": "YOUR_ASSISTANT_ID",
    "partitions": { "customer_id": "4712" }
  }'

401

{ "error": "invalid_api_key" }

Every request carries your API key in the Authorization header:

Authorization: Bearer lyra_sk_...

Create keys in Settings → Developers → API keys. A key starts with lyra_sk_ and belongs to one workspace: it reaches that workspace’s assistants only. The dashboard shows the secret once, when you create the key.

Keep the key on your server

The key opens sessions for any customer. Anyone who has it can read your customers’ answers.

• Store it in an environment variable, never in the repository.
• Never send it to a browser or a mobile app. @concatflow/node refuses to run in a browser.
• If a key leaks, revoke it in the dashboard and create another. A revoked key fails at once with 401 invalid_api_key.

The key is checked before anything else: a request with a missing or wrong key always gets 401, whatever else is wrong with it.