API Authentication & Keys

API Authentication & Keys

The Carfluence API supports two authentication methods: JWT tokens for user sessions and API keys for programmatic access.

Base URL

https://app.carfluence.io/api/v1

Method 1: JWT Token Authentication

Best for: Dashboard sessions, user-facing applications.

Login:

POST /api/v1/auth/login
Content-Type: application/json

{
  "email": "[email protected]",
  "password": "your-password"
}

Response:

{
  "token": "eyJhbGciOiJSUzI1NiIs...",
  "user": {
    "id": "uuid",
    "email": "[email protected]",
    "name": "John Doe"
  }
}

Using the token:

GET /api/v1/inventory
Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

Refresh an expired token:

POST /api/v1/auth/refresh
Content-Type: application/json

{
  "refreshToken": "your-refresh-token"
}

Method 2: API Key Authentication

Best for: Server-to-server integrations, CI/CD, automated scripts.

Create an API key:

POST /api/v1/api-keys
Authorization: Bearer <admin-jwt>
Content-Type: application/json

{
  "name": "Partner Integration Key",
  "scopes": ["inventory:read", "dealers:read"],
  "rateLimitPerHour": 1000
}

Available Scopes:

Using an API key:

GET /api/v1/inventory
X-API-Key: cf_live_abc123def456...

Rate Limiting

• •Default: 1000 requests per hour per key
• •Configurable per API key at creation time
• •Rate limit headers included in every response:
• •X-RateLimit-Limit: Your limit
• •X-RateLimit-Remaining: Requests remaining
• •X-RateLimit-Reset: Unix timestamp when the window resets

Error Responses