Security

// Browser code - do not do this
const token = "kfmsg_live_token";

// Backend code
const baseUrl = process.env.KARFLOWS_BASE_URL || "https://karflows.com";

await fetch(`${baseUrl}/api/omni/send`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.KARFLOWS_UNIFIED_TOKEN}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify(payload)
});