Looking for the full interactive reference?

Open API Reference →

Authentication

Every public API request is authenticated with an org-scoped API key. Per-install credentials are auto-provisioned when a consumer installs an addon. OAuth 2.0 server endpoints (authorize/callback/token) are not implemented in v2.1.

API key model

Mint a key from the GA Flight console at Settings → Integrations → API Keys. The plaintext token is shown exactly once; we store only a SHA-256 hash. Send the bearer header and the X-Org-Id header on every request.

bash
curl https://api.gaflight.io/api/v1/public/pilots \
  -H "Authorization: Bearer gaf_pk_<your-token>" \
  -H "X-Org-Id: <your-organization-uuid>"

Per-install credentials

When a consumer organization installs an addon listing, the platform auto-provisions a unique API key bound to the (developer_app, consumer_org) pair. Installer secrets are revealed plaintext-once in the post-install screen — capture them then. There is no read-back endpoint.

Rotation

API keys can be rotated from the console. Webhook signing secrets use a separate dual-secret 72h grace pattern — see the webhooks page for the rotation contract.

OAuth — planned, not delivered

OAuth 2.0 server endpoints (authorize/callback/token) are not implemented in v2.1. The v2.x roadmap tracks this; see the changelog. Until then, use the API key model above.

Rate limits

Every authenticated response includes per-key rate-limit headers. Window length is 60 seconds. A 429 response includes the same headers; back off until the reset window.

http
HTTP/1.1 200 OK
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 597
X-RateLimit-Reset: 60