Flok REST API

Authentication

All requests use a personal API token, created in Settings → API keys. Send it as a bearer token:

GET /v1/members
Authorization: Bearer flok_live_a1b2c3…
X-Tenant-Slug: my-club

Tokens are scoped to a single tenant and inherit the role you assign at creation time. Rotate them any time from the UI.

Rate limits

60 requests / minute per token, burst 120. Exceeded requests return 429 Too Many Requests with a Retry-After header.

Errors

Errors follow a stable shape:

{
  "error": {
    "code": "member_not_found",
    "message": "No member with id mbr_123 in tenant my-club.",
    "status": 404
  }
}

Members

# Create a member
curl -X POST https://api.getflok.app/v1/members \
  -H "Authorization: Bearer $FLOK_TOKEN" \
  -H "X-Tenant-Slug: my-club" \
  -H "Content-Type: application/json" \
  -d '{
    "first_name": "Ada",
    "last_name": "Lovelace",
    "email": "ada@example.org",
    "membership_id": "mem_active_adult"
  }'

Memberships

Assign, transition or end a member's active plan. Only one active membership per member is enforced server-side.

Invoices

Events

Webhooks

Subscribe to real-time events (member created, invoice paid, ticket purchased). Payloads are signed with HMAC-SHA256 in the X-Flok-Signature header.

{
  "id": "evt_9f2c…",
  "type": "invoice.paid",
  "created_at": "2026-07-20T10:14:22Z",
  "data": { "invoice_id": "inv_1234", "amount": 4500 }
}