API Keys
API keys authenticate server-to-server requests to the FileNest API. They are managed by the FileNest IAM and scoped to an organization.
Key prefixes
| Prefix | Use |
|---|---|
fn_live_... | Production environment |
fn_test_... | Test / sandbox environment |
Keep keys secret
API keys are long-lived credentials. Never commit them to source control or expose them in client-side code.
Scopes
Every API key carries a set of scopes that restrict what it can do. Scopes are grouped by resource so you can create purpose-specific keys with the minimum permissions needed.
| Scope | Description |
|---|---|
files:upload | Upload files (single and multipart) |
files:download | Generate presigned download URLs |
files:read | List and get file metadata and version history |
files:delete | Delete files |
files:metadata | Update file metadata, tags, and filename |
folders:read | List folders, resolve paths, list files in folder |
folders:write | Create folders, ensure paths, move files, delete folders |
upload_tokens:create | Issue short-lived browser upload tokens |
webhooks:read | List webhook endpoints and delivery history |
webhooks:write | Create, update, and delete webhook endpoints |
projects:read | Read project configuration, usage, and dashboard |
projects:update | Update project settings and storage configuration |
audit:read | Read audit log entries |
compliance:manage | Configure WORM, legal hold, and retention policies |
Generating a key
API keys are generated in the Console under API Keys inside a project, or during the onboarding wizard. The full key value is shown exactly once — save it immediately.
Using a key
Pass the key as a Bearer token in the Authorization header:
curl https://filenest.drgodly.com/v1/projects/{id}/files \
-H "Authorization: Bearer fn_live_abc123..."Upload tokens
For browser-side uploads, use short-lived upload tokens (fn_upload_token_...) instead of API keys. These are generated by your server and issued to the browser through a token endpoint. See React SDK for the setup.
Revoking a key
Revoked keys are immediately rejected. Revocation is permanent — you cannot restore a revoked key.