Share studio

The hosted studio where your users make stories, feed posts, banners and QR codes that carry their own link.

GET/v1/share/assets

The postcards, posters and cards one of your users has made, newest first, each with its own code, results and a signed image link to show in your app.

AuthSigned request with an app key, fg_live_… or fg_test_…

Query parameters

appUserIdstringrequired≤ 200 chars

Your pseudonymous id for the user. Never an email address or phone number.

Returns · 200

itemsarray of objectsrequired

Child attributes

idstringrequireduuid

namestringrequired

programIdstringrequireduuid

templateIdstringrequireduuid

templateNamestringrequired

formatstringrequired

One of story square portrait landscape link_banner leaderboard rectangle postcard poster card

widthintegerrequired

Pixels.

heightintegerrequired

printobjectrequirednullable

Paper size, for printable formats.

Child attributes

widthMmnumberrequired

heightMmnumberrequired

destinationstringrequired

What the QR code and link open: the tracking link itself, or the referrer’s landing page first.

One of direct landing

landingobjectrequired

The greeting and first name shown on the landing page, when the referrer chose them.

codestringrequired

The asset’s own invite code.

urlstringrequireduri

What the QR code opens.

createdAtstringrequireddate-time

programNamestringrequired

appNamestringrequired

clicksintegerrequired

registrationsintegerrequired

qualifiedintegerrequired

svgUrlstringrequireduri

The finished image as SVG. Works without a session for a day; ask again for a fresh one.

Errors

400validation_error: The request does not match the schema. details says which fields failed and why.
401missing_signature: One of x-fg-key, x-fg-timestamp and x-fg-signature is missing.
401invalid_timestamp: x-fg-timestamp is not Unix time in seconds.
401stale_timestamp: x-fg-timestamp is more than 300 seconds from the server clock. Sign each attempt again, and keep your clock in sync.
401invalid_key: The key id is unknown or revoked, or the app is archived.
401invalid_signature: The signature does not match. Sign the exact bytes you send.

Request

TS=$(date +%s)
SIG=$(printf '%s.' "$TS" | openssl dgst -sha256 -hmac "$FG_SECRET" | sed 's/^.*= //')

curl "https://api.flowgroup.se/v1/share/assets?appUserId=u_1042" \
  -H "x-fg-key: $FG_KEY_ID" \
  -H "x-fg-timestamp: $TS" \
  -H "x-fg-signature: $SIG"

import { createFlowGrowth } from '@flow/growth-sdk';

const fg = createFlowGrowth({
  baseUrl: 'https://api.flowgroup.se',
  keyId: process.env.FG_KEY_ID!, // fg_test_… in the sandbox
  secret: process.env.FG_SECRET!,
});

const res = await fg.listShareAssets('u_1042');

200 OK

{
  "items": [
    {
      "id": "3f1c8a52-6c1e-4b8e-9d0a-2b7f0c4e5a91",
      "name": "name",
      "programId": "3f1c8a52-6c1e-4b8e-9d0a-2b7f0c4e5a91",
      "templateId": "3f1c8a52-6c1e-4b8e-9d0a-2b7f0c4e5a91",
      "templateName": "templateName",
      "format": "story",
      "width": 1,
      "height": 1,
      "print": {
        "widthMm": 1,
        "heightMm": 1
      },
      "destination": "direct",
      "landing": {
        "key": null
      },
      "code": "k7qxa2mp",
      "url": "https://example.com",
      "createdAt": "2026-11-09T12:00:00.000Z",
      "programName": "programName",
      "appName": "appName",
      "clicks": 1,
      "registrations": 1,
      "qualified": 1,
      "svgUrl": "https://example.com"
    }
  ]
}

POST/v1/share/sessions

A link to the hosted studio for one of your users, where they make postcards, posters and QR codes that carry their own link. Open it in a WebView or a browser tab. It works for about half an hour; ask for a new one each time the user opens the studio. Creates their referrer account on first use, and needs a production key.

AuthSigned request with an app key, fg_live_… or fg_test_…

Request body

appUserIdstringrequired≤ 200 chars

Your pseudonymous id for the user. Never an email address or phone number.

localestringdefault sv

Language of the studio.

One of sv en

Returns · 201

urlstringrequireduri

expiresAtstringrequireddate-time

Errors

400validation_error: The request does not match the schema. details says which fields failed and why.
401missing_signature: One of x-fg-key, x-fg-timestamp and x-fg-signature is missing.
401invalid_timestamp: x-fg-timestamp is not Unix time in seconds.
401stale_timestamp: x-fg-timestamp is more than 300 seconds from the server clock. Sign each attempt again, and keep your clock in sync.
401invalid_key: The key id is unknown or revoked, or the app is archived.
401invalid_signature: The signature does not match. Sign the exact bytes you send.
404not_found: Your app has no active friend-referral program.
409production_only: Sent with a sandbox key: the studio would hand out real links to test users.

Request

BODY='{"appUserId":"u_8F2K","locale":"sv"}'
TS=$(date +%s)
SIG=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$FG_SECRET" | sed 's/^.*= //')

curl -X POST "https://api.flowgroup.se/v1/share/sessions" \
  -H "content-type: application/json" \
  -H "x-fg-key: $FG_KEY_ID" \
  -H "x-fg-timestamp: $TS" \
  -H "x-fg-signature: $SIG" \
  --data-raw "$BODY"

import { createFlowGrowth } from '@flow/growth-sdk';

const fg = createFlowGrowth({
  baseUrl: 'https://api.flowgroup.se',
  keyId: process.env.FG_KEY_ID!, // fg_test_… in the sandbox
  secret: process.env.FG_SECRET!,
});

const res = await fg.createShareSession({ appUserId: 'u_1042', locale: 'en' });
if (res.ok) openWebView(res.data.url);

201 Created

{
  "url": "https://partners.flowgroup.se/share/s/9Qm2…",
  "expiresAt": "2026-11-09T10:00:00.000Z"
}

List a user’s share material#

Open the share studio for a user#

List a user’s share material

Open the share studio for a user