Fimaflow team

Public API with API keys

An API you can hand to other developers: you create a key for each client, they send it in the X-API-Key header, and the product list is served from a short cache that is cleared whenever a product changes.

Backend templateAPI keys · Cache · PostgreSQL · Rate limit59 nodes4 endpoints

The flows

Setup — creates the api_keys and products tables, and feeds DATABASE_URL and ADMIN_KEY to every flow.
POST /keys — admin only: the X-API-Key header must match ADMIN_KEY (a 401 otherwise). It validates the client name, generates a key, stores only its bcrypt hash plus a short prefix, and answers 201 with the key, shown this one time.
DELETE /keys/:id — admin only: looks the key up (a 404 if it does not exist) and deletes it. The client's key stops working immediately.
GET /products — the client's X-API-Key is checked against the stored hashes (a 401 if it is missing, wrong or revoked). The list comes from a 60-second cache when it can, otherwise from the database, and is then cached.
POST /products — same key check, then validates name and price, creates the product and clears the cache so the next list is fresh.

What's included

Admin routes to create and revoke keys, protected by an ADMIN_KEY checked with the API Key node
Keys are generated once and shown once: only a bcrypt hash is stored, with a short prefix to find it
Client routes (list and create products) that answer 401 for a missing, wrong or revoked key
A 60-second cache on the product list: the answer says whether it came from the cache or the database, and a new product clears it
A rate limit on every route and a CORS node, plus a Setup flow that creates the api_keys and products tables
The cache lives in memory and resets when the engine restarts: switch the Cache nodes to Redis for production
Set DATABASE_URL and ADMIN_KEY (a long random string) in the Environment node, then send it as X-API-Key to create your first client key