SendFlo API

One API for humans and agents: share links, staged transfers, file requests. Bytes never transit the API — uploads go direct to storage via presigned URLs; the API is the control plane. Base URL: https://api.sendflo.app. Errors are RFC 9457 problem documents. Every example on these pages is runnable.

Auth in two shapes

Humans sign in on SendFlo — email and password, Google or company single sign-on, plus a code from their authenticator app if they turned two-factor on — and hold short-lived session tokens (the refresh token is an httpOnly cookie — browsers never see it). Agents and scripts hold API keys (Settings → Developer) — a separate credential class with scopes, per-key rate limits and revocation. Keys are shown once at creation, then only their hash exists.

# Every request carries the key as a bearer token
curl https://api.sendflo.app/v1/credits \
  -H "authorization: Bearer $SENDFLO_API_KEY"

Workspaces

Every resource lives in a workspace — your personal one, or an org-owned team seat workspace. Sessions are scoped to ONE active workspace; switch with POST /v1/auth/workspace. Isolation is structural, not a filter. Plans, seats, roles, and org policy live in Teams & workspaces.

First transfer

# Create a staged transfer — the response carries presigned multipart part URLs
curl -X POST https://api.sendflo.app/v1/transfers \
  -H "authorization: Bearer $TOKEN" -H "content-type: application/json" \
  -d '{"name":"report.pdf","size":1048576}'

# PUT each part to its URL, then complete:
curl -X POST https://api.sendflo.app/v1/transfers/<id>/complete \
  -H "authorization: Bearer $TOKEN" -H "content-type: application/json" \
  -d '{"parts":[{"part_number":1,"etag":"<from-the-PUT-response>"}]}'