Integrations and API

Connect scripts, editor plugins, browser extensions or your own apps. A client needs two separate secrets:

Secret	What it unlocks	Where it comes from
API token (nf_…)	Talking to the API: fetching and storing encrypted notes	NoteFlare → Account → Integrations
Passphrase	Reading and writing note content	You. It never leaves the client

A token on its own exposes nothing readable.

Create a token

Under Account → Integrations, create a token. It is shown once.

Scope	Can	Can’t
read	Read the vault, list and fetch notes	Create, change or delete anything
write	Everything read can, plus create, update, trash, restore and delete notes	Manage tokens or change the passphrase

Tokens can expire after 30 days, 90 days or a year, and can be revoked at any time.

TypeScript SDK

import { NoteFlareClient } from '@noteflare/client'

const nf = new NoteFlareClient({ url: 'https://notes.example.com', token: 'nf_…' })
await nf.unlock(passphrase)                       // decryption stays on your side
await nf.create({ title: 'From my script', body: '- [ ] it works' })

CLI

export NOTEFLARE_URL=https://notes.example.com
export NOTEFLARE_TOKEN=nf_…            # a write token
node packages/cli/bin/noteflare.mjs ls
echo "- [ ] Pack a jacket" | node packages/cli/bin/noteflare.mjs append trip
node packages/cli/bin/noteflare.mjs export ./backup    # Markdown you can re-import

The CLI asks for the passphrase, or reads NOTEFLARE_PASSPHRASE.

Let API clients through Cloudflare Access

Access protects the whole domain with a browser login, which a script can’t complete. Pick one of these for the /api/v1 path.

Option A: Bypass (simplest). Every /api/v1 request must still carry a NoteFlare token.

1. In Zero Trust → Access → Applications, add a Self-hosted application.
2. Domain: your NoteFlare domain. Path: api/v1.
3. Policy: action Bypass, include Everyone.

Option B: Service Auth (defence in depth). Requests need a Cloudflare Access service token and a NoteFlare token.

1. Zero Trust → Access → Service Auth → Create service token. Copy the Client ID and Secret.
2. Add a Self-hosted application for path api/v1 with a Service Auth policy that includes that service token.
3. Send CF-Access-Client-Id and CF-Access-Client-Secret on every request.

Tip

With option A, add a Cloudflare rate-limiting rule for /api/v1/*. One rule is available on the free plan.

Full reference

API guide on GitHubEndpoints, syncing, conflict handling, errors and limits, and the exact encryption format with a Python example.

The OpenAPI 3.1 description is served by your own deployment at /api/v1/openapi.json.