flowawsome

Identity, approval workflows, and access control — one API.

flowawsome gives internal tools and B2B products login, approval routing, and service-level authorization without rebuilding any of the three from scratch. Every endpoint sits under a single account, secured with either a session token or an API key.

Quickstart API Reference

Three engines, one account

Identity, Access Control, and Workflow are independent engines with a fixed, one-way dependency direction — Access Control reads from Identity and Workflow (never writes to either), and Workflow reads from Identity. This is also how the Reference page is organized: each engine is its own API document.

IdentityIdentity API: Login sessions, MFA (TOTP), OAuth/SAML provider adapters, organizations, departments, job titles, and membership roles.
Access ControlAccess Control API: App/service-scoped API keys, and flat grants (explicit, department-derived, job-title-derived) that decide whether a caller can reach a service.
WorkflowWorkflow API: Approval definitions, five-level resolution (individual → department → service → app → org), instance routing, step actions, and outbound webhooks.

Base URL

All REST endpoints are served from a single host:

https://api.flowawsome.com/v1

Authentication

Two credential types, for two different callers:

Bearer token — a JWT issued by POST /auth/login, used by end-users acting as themselves (admin console, a self-serve login screen you build).
API key (X-Api-Key) — issued by Access Control, scoped to one app or service, used by another system calling server-to-server (creating a workflow instance, checking service access).

Verifying things server-side

@flowaws/node-sdk is a small, server-only package for verifying access tokens and webhook signatures locally, without calling back into the API. It doesn't wrap login or the rest of the REST surface — see the Quickstart for both the SDK path and the plain-REST path.