Flow.Documentation
ProfessionalAPIs

Sign in with HTTP Basic

6 steps± 4 minVideoVerified 22 Oct 2026
  1. Step 1 · Open your development environment
  2. Step 2 · A policy with HTTP Basic
  3. Step 3 · Attach the policy to the API
  4. Step 4 · Create a client for the system
  5. Step 5 · Call the API with Basic
  6. Step 6 · See who called

Some systems can only send a user name and password: HTTP Basic. In Flow that is a client with a client_id and a client_secret, the same as for OAuth 2.0. You create a security policy with HTTP Basic, attach it to an API, create a client and call the API the way that system does.

Watch the whole guide as a video6 steps in one film
Step 1 / 6

Open your development environment

In the portal, under Environments, click Development, and there Open. Flow opens in a new tab and you are signed in straight away.

  1. Click Development
Open your development environment · Click Development
  1. Click Open ↗
Open your development environment · Click Open ↗
Step 2 / 6

A policy with HTTP Basic

Under Security click ＋ next to Security policies. Give it a name, switch API key off and HTTP Basic on. Above, in plain language, it says who gets in.

  1. Click Security
A policy with HTTP Basic · Click Security
  1. Click New security policy
A policy with HTTP Basic · Click New security policy
  1. In Name, type Till systems (Basic)
A policy with HTTP Basic · In Name, type Till systems (Basic)
  1. Click API key X-API-Key or Bearer flw_…
A policy with HTTP Basic · Click API key X-API-Key or Bearer flw_…
  1. Click HTTP Basic client_id:client_secret
A policy with HTTP Basic · Click HTTP Basic client_id:client_secret
  1. Click Save policy
A policy with HTTP Basic · Click Save policy
A policy with HTTP Basic · A consumer gets in with HTTP Basic.
Step 3 / 6

Attach the policy to the API

Open the API and choose the policy under Security policy. Every endpoint of the API inherits it.

  1. Click Explorer
Attach the policy to the API · Click Explorer
  1. Click the API
Attach the policy to the API · Click the API
  1. In Security policy, choose Till systems (Basic)
Attach the policy to the API · In Security policy, choose Till systems (Basic)
  1. Click Save API
Attach the policy to the API · Click Save API
Attach the policy to the API · In plain language: consumers get in with HTTP Basic.
Step 4 / 6

Create a client for the system

Under Security → OAuth clients you add a consumer and click Create OAuth client. You get a client_id and a client_secret: with HTTP Basic those are the user name and the password. You see the secret only once.

  1. Click Security
Create a client for the system · Click Security
  1. Click OAuth clients
Create a client for the system · Click OAuth clients
  1. In Name, type Till shop Centre
Create a client for the system · In Name, type Till shop Centre
  1. Click Create OAuth client
Create a client for the system · Click Create OAuth client
Create a client for the system · client_id and client_secret (covered up), visible once.
  1. Click I have stored it
Create a client for the system · Click I have stored it
Step 5 / 6

Call the API with Basic

In Test APIs (in the bar on the left) you choose the endpoint. Set Authentication to None and add the header Authorization with Basic followed by client_id:client_secret in base64 — what every system with Basic support does by itself.

  1. Click Test APIs
Call the API with Basic · Click Test APIs
  1. Click the endpoint
Call the API with Basic · Click the endpoint
  1. Click None
Call the API with Basic · Click None
  1. Click ＋ Add
Call the API with Basic · Click ＋ Add
  1. In Name, type Authorization
  2. In Value, type ••••••••
Call the API with Basic · In Name, type Authorization; In Value, type ••••••••
  1. Click ▶ Send
Call the API with Basic · Click ▶ Send
Call the API with Basic · 200: client_id and secret match.
Step 6 / 6

See who called

Under Runs → Live traffic you find every call, with the client that signed in and the method basic. That way every call can be traced to one system.

  1. Click Runs
See who called · Click Runs
  1. Click Live traffic
See who called · Click Live traffic
See who called · The call: 200, signed in with basic, with the client_id.

This guide was carried out step by step on 22 Oct 2026 by an automated test on Flow (version 3e563176).