FlashData API V2

Authentication

Management requests use an opaque web session. Data requests use a scoped FlashData API key.

Data API keys

Send a scoped key in X-API-Key. Test and live keys are separate, plaintext is shown once, and revocation is immediate.

HTTP header

X-API-Key: fd_test_REPLACE_ONCE

Web sessions

The product console uses a Secure, HttpOnly, SameSite=Lax host-only cookie. Browser JavaScript never receives the opaque session token. State changes also require exact Origin validation and a session-bound CSRF token.

Restricted sessions

legal_acceptance and deletion_recovery sessions expose only their recovery workflow, CSRF, account summary, and logout. They cannot read workspace or billing data.