Getting started

Authentication

Session, User ID, and API key

GET/api/settings/api-keyAuth

API key status (prefix only)

POST/api/settings/api-keyAuth

Generate or regenerate API key (shown once)

json

{
  "apiKey": "uf_…",
  "prefix": "uf_xxxx",
  "userId": "cl…"
}

DELETE/api/settings/api-keyAuth

Revoke the API key

Dashboard session

After login, the HTTP-only unlockfy_session cookie authenticates browser calls.

API key (server-to-server)

Generate the key in Dashboard → API. Send:

text

Authorization: Bearer uf_YOUR_KEY

or X-Api-Key: uf_YOUR_KEY.

Required for:

GET/POST /api/links
PATCH/DELETE /api/links/{id}
POST /api/links/bulk-delete

User ID (Full Script)

User ID is public (script embed). The API key is secret — never put it in frontend code.

Session-only (not API key)

Profile, payouts, and settings (except API key routes) use the dashboard cookie only. Payouts are not a public API — request them from the Dashboard.