API reference · App API
Account links
Connect one of your users to their Flow Affiliate account, so they can follow what they referred.
Start linking an account
/v1/account-links/sessionsA one-time page where your signed-in user connects their account in your app to their Flow Affiliate account. Open the url in the system browser, not a WebView: the person signs in there, with BankID by default. It works once, for 15 minutes, and needs a production key.
AuthSigned request with an app key, fg_live_… or fg_test_…
Request body
appUserIdstringrequiredYour pseudonymous id for the user. Never an email address or phone number.
returnUrlstringWhere the page sends the person when they are done: your https page or an app-scheme URL.
Returns · 201
urlstringrequiredOpen this for the user.
expiresAtstringrequiredErrors
- 400
validation_error The request does not match the schema.
detailssays which fields failed and why.- 401
missing_signature One of
x-fg-key,x-fg-timestampandx-fg-signatureis missing.- 401
invalid_timestamp x-fg-timestampis not Unix time in seconds.- 401
stale_timestamp x-fg-timestampis more than 300 seconds from the server clock. Sign each attempt again, and keep your clock in sync.- 401
invalid_key The key id is unknown or revoked, or the app is archived.
- 401
invalid_signature The signature does not match. Sign the exact bytes you send.
- 409
production_only Sent with a sandbox key. Account links are real identities.
BODY='{"appUserId":"u_8F2K","returnUrl":"nordshop://settings/flow"}'
TS=$(date +%s)
SIG=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$FG_SECRET" | sed 's/^.*= //')
curl -X POST "https://api.flowgroup.se/v1/account-links/sessions" \
-H "content-type: application/json" \
-H "x-fg-key: $FG_KEY_ID" \
-H "x-fg-timestamp: $TS" \
-H "x-fg-signature: $SIG" \
--data-raw "$BODY"import { createFlowGrowth } from '@flow/growth-sdk';
const fg = createFlowGrowth({
baseUrl: 'https://api.flowgroup.se',
keyId: process.env.FG_KEY_ID!, // fg_test_… in the sandbox
secret: process.env.FG_SECRET!,
});
const res = await fg.createAccountLinkSession({
appUserId: 'u_1042',
returnUrl: 'myapp://settings/partner',
});
if (res.ok) openInSystemBrowser(res.data.url);{
"url": "https://partners.flowgroup.se/connect/3Jx9…",
"expiresAt": "2026-11-09T09:45:00.000Z"
}Check whether a user is linked
/v1/account-linksWhether one of your users has linked their account, so the app can show "connected" instead of the button.
AuthSigned request with an app key, fg_live_… or fg_test_…
Query parameters
appUserIdstringrequiredYour pseudonymous id for the user. Never an email address or phone number.
Returns · 200
linkedbooleanrequiredlinkedAtstringrequiredErrors
- 400
validation_error The request does not match the schema.
detailssays which fields failed and why.- 401
missing_signature One of
x-fg-key,x-fg-timestampandx-fg-signatureis missing.- 401
invalid_timestamp x-fg-timestampis not Unix time in seconds.- 401
stale_timestamp x-fg-timestampis more than 300 seconds from the server clock. Sign each attempt again, and keep your clock in sync.- 401
invalid_key The key id is unknown or revoked, or the app is archived.
- 401
invalid_signature The signature does not match. Sign the exact bytes you send.
TS=$(date +%s)
SIG=$(printf '%s.' "$TS" | openssl dgst -sha256 -hmac "$FG_SECRET" | sed 's/^.*= //')
curl "https://api.flowgroup.se/v1/account-links?appUserId=u_1042" \
-H "x-fg-key: $FG_KEY_ID" \
-H "x-fg-timestamp: $TS" \
-H "x-fg-signature: $SIG"import { createFlowGrowth } from '@flow/growth-sdk';
const fg = createFlowGrowth({
baseUrl: 'https://api.flowgroup.se',
keyId: process.env.FG_KEY_ID!, // fg_test_… in the sandbox
secret: process.env.FG_SECRET!,
});
const res = await fg.getAccountLink('u_1042');{
"linked": true,
"linkedAt": "2026-11-09T09:41:12.000Z"
}