API Authentication

June 26, 2026

Summary

Every Flxpoint API request must be authenticated with an access token passed as a bearer token in the Authorization header. Flxpoint issues separate, context-scoped tokens for Sources, Channels, and Resellers (B2B); this page covers each token type, how to generate and send it, and how to resolve 401 errors.

Overview

Every request to the Flxpoint API must be authenticated with an access token, passed as a bearer token in the request header. Flxpoint issues different tokens for different situations - one for Sources, one for Channels, and one for Resellers - and each token is only valid for the endpoints tied to that context.

Full endpoint reference and request schemas live in the API documentation at flxpoint.stoplight.io. This page covers how authentication itself works. You can also visit our Flxpoint API Help Center.

The three token types

Source token

Unlocks all Source endpoints: create/update inventory, get/acknowledge/cancel fulfillment requests, and create shipments.

Channel token

Unlocks Channel endpoints: sync/publish listings, post sync & publish responses, create B2C orders, and get shipments & order status.

Reseller token

Lets an approved dealer submit and check B2B orders that are isolated to their own dealer account.

Which token for which endpoints

Context	Endpoints it unlocks	How the token is obtained
Source	Create/Update Source Inventory · Get Fulfillment Requests/Orders · Acknowledge FR/FO · Cancel FR/FO · Create Shipment(s)	The Flxpoint user generates the token from the Source.
Channel (Products)	Get Listings to Sync · Post Sync Responses · Get Listings to Publish · Post Publish Responses	The Flxpoint user generates the token from the Channel.
Channel (B2C ordering)	Create New Order · Get Shipments · Get Order Status	The Flxpoint user generates the token from the Channel.
Reseller (B2B ordering)	Create New Order · Get Shipments · Get Order Status	The reseller retrieves their token from the Reseller Portal.

Generating an access token

For a Source

A Source token makes all Source endpoints accessible for that Source.

Log in to the Flxpoint application at app.flxpoint.com.
Go to View All Sources.
Configure the Source you want a token for.
On the Basic Info screen, find the API Access section.
If no token exists yet, click Grant Access to generate one.
Copy the token and use it to interact with that Source via the API.

For a Channel

A Channel token makes all Channel endpoints accessible for B2C channels, and product access for B2B channels.

Log in to the Flxpoint application at app.flxpoint.com.
Go to View All Channels.
Choose Sales Channels (B2C) or Reseller Channels (B2B).
Configure the Channel you want a token for.
On the Basic Info screen, find the API Access section.
If no token exists yet, click Grant Access to generate one.
Copy the token and use it to interact with that Channel via the API.

For a Reseller

A Reseller token lets a dealer submit and check orders that are isolated to their own dealer account.

The dealer logs in to the Reseller Portal for the Flxpoint user (for example, custom-subdomain.flxpoint.com).
Once the dealer is approved, the API token appears on their Settings page.
If the dealer is not yet approved, they must reach out to the Flxpoint user for approval first.
The dealer uses this token to authenticate B2B ordering in the API.

Using a token in a request

Include the access token in every request, passed as a bearer token in the Authorization header.

Authorization: Bearer {Access Token}

Treat the token like a password. Anyone holding it can act against the Source, Channel, or dealer account it belongs to.

Watch out for

Tokens are scoped to one context

A token only works for the endpoints tied to its context. A Source token cannot create orders on a Channel, and a Channel token cannot create orders on B2B (reseller) channels - that requires a Reseller token. Using the wrong token returns 401.

Regenerating a token revokes the old one

If you regenerate a token from the UI, the previous token stops working immediately. Any integration still sending the old token will start getting 401 until you swap in the new one.

Resellers must be approved first

A dealer's token does not appear on their Settings page until the Flxpoint user has approved the reseller. Unapproved dealers have no token to authenticate with.

The token must be on every request

There is no session - the bearer token has to be present in the Authorization header of each call. A request with a missing, malformed, or invalid token returns 401.

Common issues

401 - Unauthorized

The token is invalid, has been revoked, or was regenerated from the UI. Confirm you are sending the current, correct token for this context.

401 on a valid token

The token is correct but not permitted for that endpoint. Make sure you are using an allowed endpoint for the token's context - for example, a Source token cannot create new orders on a Channel.

B2B order rejected

A Channel token cannot create orders on B2B (reseller) channels. Use a Reseller / B2B token for reseller ordering.

No token on the dealer's Settings page

The reseller has not been approved yet. The Flxpoint user must approve the dealer before a token is issued.

FAQs

How do I send the token in a request?▸

Pass it as a bearer token in the Authorization header on every request: Authorization: Bearer {Access Token}. There is no session, so the token must be present on each call.

Why am I getting a 401 even though my token looks correct?▸

A 401 means the token is invalid, revoked, regenerated, or not permitted for that endpoint. Re-check that you are using the right token for the context - a Source token cannot create orders on a Channel, and a Channel token cannot create B2B orders.

Can one token work across Sources, Channels, and resellers?▸

No. Tokens are scoped. A Source token only unlocks Source endpoints, a Channel token only unlocks Channel endpoints, and a Reseller token only handles B2B ordering for that dealer's account.

What happens to my old token if I regenerate it?▸

Regenerating a token from the UI revokes the previous one. Any integration still sending the old token will get a 401 until you update it to the new token.

A reseller can't find their API token - why?▸

The token only appears on the dealer's Settings page in the Reseller Portal once they have been approved by the Flxpoint user. Unapproved dealers must request approval first.

Where do I find the full list of API endpoints?▸

The complete endpoint reference and request schemas are published in the API documentation at flxpoint.stoplight.io.

Back to API & EDI