Fliplet.App.Tokens

Read the list of API tokens an app has issued to external services and backend integrations. Each token represents a non-human “app user” account with scoped access (viewer role, by default) that lets a trusted backend system, webhook, or third-party integration authenticate against the Fliplet API on behalf of the app.

This package is a thin client over the v1/apps/{appId}/tokens REST endpoint and exposes a single global, Fliplet.App.Tokens. Use it when an app or admin screen needs to display, audit, or correlate the tokens that have been provisioned for backend integrations.

Note: Creating and deleting tokens is performed in Fliplet Studio (App Settings → Security → API tokens) or directly via the REST API. The client library is intentionally read-only.

Install

Add the fliplet-tokens dependency to your screen or app resources. The package depends on fliplet-core and registers itself under Fliplet.App.Tokens.

Fliplet.App.Tokens.get()

(Returns Promise<Array>)

Fetch the list of tokens issued for an app. Wraps GET v1/apps/{appId}/tokens and resolves with the appTokens array from the response body.

Usage

const tokens = await Fliplet.App.Tokens.get();

// tokens is an array of objects:
// [
//   {
//     id: 12345,
//     firstName: 'Zapier integration', // the token's display name
//     lastName: null,
//     email: '[email protected]',
//     auth_token: 'eyJhbGciOi...',     // the bearer token value
//     type: 'appToken'
//   },
//   ...
// ]

• options (Object, optional) Configuration for the request.
  • appId (Number) The app id to read tokens for. Defaults to Fliplet.Env.get('appId'). Throws Error: appId is required when neither is set.
  • query (Object) Query string parameters forwarded to the REST endpoint. The endpoint accepts:
    • type (String) Filter by token type. Defaults to appToken. Pass integrationToken to read integration-only tokens.
    • order (String) Field to order results by. Defaults to firstName.
    • direction (String) ASC or DESC. Defaults to ASC.

Examples

Read all tokens for the current app

const tokens = await Fliplet.App.Tokens.get();

tokens.forEach((token) => {
  console.log(token.firstName, token.id);
});

Read tokens for a specific app

const tokens = await Fliplet.App.Tokens.get({ appId: 1234 });

Filter to integration tokens, newest first

const tokens = await Fliplet.App.Tokens.get({
  query: {
    type: 'integrationToken',
    order: 'id',
    direction: 'DESC'
  }
});

Response shape

Each item in the resolved array is an “app user” record representing a token:

Token types

• appToken — General-purpose API token scoped to the app. Granted the viewer app role.
• integrationToken — Token reserved for first-class integrations (e.g. Zapier, webhook receivers, server-to-server jobs). Subject to the appSecurity.tokenManagement plan feature; creation and deletion fail with a billing error if the organisation’s plan does not include it.

Using a token to call the Fliplet API

Once you have an auth_token, a backend service can call any Fliplet API endpoint that the app role permits by sending the token as a header. Tokens carry the viewer app role, so they can read app data sources, app submissions, and similar read-scoped resources.

// From a backend (Node, Python, curl, etc.) — never expose tokens in the browser.
fetch('https://api.fliplet.com/v1/data-sources/1234/data', {
  headers: {
    'Auth-token': process.env.FLIPLET_APP_TOKEN
  }
}).then((r) => r.json());

curl https://api.fliplet.com/v1/apps/$APP_ID/tokens \
  -H "Auth-token: $FLIPLET_APP_TOKEN"

Access and security

• Authentication required. The underlying v1/apps/{appId}/tokens endpoint requires an authenticated request — typically a Studio user session or a token that already has access to the app. Calling Fliplet.App.Tokens.get() from a public, unauthenticated screen will fail.
• Rate limited. The endpoint is brute-force rate-limited under the appTokens rate-limit bucket. Avoid polling it from end-user screens.
• Treat auth_token as a secret. The value functions as a long-lived password for the app. Surface it only in trusted admin contexts (e.g. a Studio settings screen visible to logged-in admins) and never log, embed, or persist it in client storage that other users can read.
• Token creation and deletion are not exposed in this client library. Use Fliplet Studio or POST / DELETE v1/apps/{appId}/tokens directly. Both write endpoints additionally enforce the appSecurity.tokenManagement plan feature when working with integrationToken records.

Back to API documentation