Fixflo Authentication

generated: '2026-07-26'
method: searched
source: openapi/fixflo-api-v2-openapi.yml
docs: https://api-docs.fixflo.com/72b66de24898e-welcome-to-fixflo
note: >-
  Two distinct, independently verified auth surfaces. (1) The documented v2 REST
  API is plain HTTP bearer: a 64-character alphanumeric token generated by a
  user from inside their own live Fixflo system and sent on every request as
  "Authorization: Bearer [token]". (2) api.fixflo.com additionally serves a real
  anonymous OpenID Connect / OAuth 2.0 discovery surface that governs the Fixflo
  application login, not the v2 REST API. Fixflo's own words: "Token based
  authentication is implemented in alignment with OAuth2 standards but the full
  range of OAuth2 functionality is not required and has not been implemented."
  Access is gated by a signed Application Developer and API Licence Agreement;
  keys are not self-serve.
summary:
  types:
  - http
  - openIdConnect
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  - password
  - refresh_token
  self_serve_credentials: false
  credential_gate: signed Fixflo Application Developer and API Licence Agreement
schemes:
- name: Bearer
  type: http
  scheme: bearer
  applies_to: Fixflo API v2 (documented REST surface)
  header: 'Authorization: Bearer [token]'
  token_format: 64-character alphanumeric string
  token_issuance: >-
    Generated by an authenticated user inside their own Fixflo system; documented
    in the Fixflo support knowledge base. Separate from the user password, so a
    third party may store it.
  applied_globally: true
  sources:
  - openapi/fixflo-api-v2-openapi.yml
  docs: https://api-docs.fixflo.com/72b66de24898e-welcome-to-fixflo
- name: FixfloApplicationOIDC
  type: openIdConnect
  applies_to: Fixflo application login (api.fixflo.com), not the v2 REST API
  openIdConnectUrl: https://api.fixflo.com/.well-known/openid-configuration
  issuer: https://api.fixflo.com/
  authorization_endpoint: https://api.fixflo.com/api/oauth2/authorize
  token_endpoint: https://api.fixflo.com/api/oauth2/token
  introspection_endpoint: https://api.fixflo.com/api/oauth2/introspection
  userinfo_endpoint: https://api.fixflo.com/api/userinfo/user
  end_session_endpoint: https://api.fixflo.com/api/oauth2/logout
  jwks_uri: https://api.fixflo.com/.well-known/jwks
  grant_types_supported:
  - password
  - authorization_code
  - refresh_token
  scopes_supported:
  - openid
  - offline_access
  - profile
  - email
  code_challenge_methods_supported:
  - plain
  - S256
  token_endpoint_auth_methods_supported:
  - client_secret_post
  - private_key_jwt
  - client_secret_basic
  id_token_signing_alg_values_supported:
  - RS256
  mtls_bound_access_tokens: false
  pushed_authorization_requests_required: false
  sources:
  - well-known/fixflo-openid-configuration.json
  - well-known/fixflo-oauth-authorization-server.json
transport:
  tls_required: true
  note: >-
    Verbatim from the docs — "Use HTTPS at all times. Tokens and personal data
    will be transported in plain text if SSL is not used. Any request not using
    SSL will error with HttpStatusCode.Unauthorized (401)."
tenancy:
  model: per-customer subdomain
  production_base_url_pattern: https://[your subdomain].fixflo.com/api/v2
  published_sandbox: https://api-sandbox.fixflo.com/api/v2
  note: >-
    A token is scoped to one Fixflo agency account, so the effective host is the
    customer's own subdomain rather than a single shared API host.