Token safety
Keep API tokens on your server. Do not expose them in frontend JavaScript, mobile apps, or public repositories.Disabled tokens
If an administrator disables a service, KarFlows immediately rejects public requests for that token. Common disabled responses:Passing tokens in tests
Bearer headers are recommended. Some legacy endpoints also accepttoken, apiKey, or api_key, but new integrations should use the Authorization header.