Authentication & Security
publishableKey
Your publishable key authenticates your application with Flatfile. This key is safe to include in client-side code. Where to find it:- Log into Platform Dashboard
- Navigate to Developer Settings → API Keys
- Copy your Publishable Key (starts with
pk_)
Security Best Practices
Environment Variables
Store your publishable key in environment variables rather than hardcoding:Common Configuration Options
These options are shared across all SDK implementations:Authentication
User Identity
Space Setup
Look & Feel
CSS Customization
You can customize the embedded Flatfile iframe and its container elements using CSS variables and class selectors. This allows you to control colors, sizing, borders, and other visual aspects of the iframe wrapper to match your application’s design.CSS Variables
Define these CSS variables in your application’s stylesheet to control the appearance of Flatfile’s embedded components:Container Elements
Target these elements to customize the iframe container:Modal Display Customization
WhendisplayAsModal is set to true, customize the modal appearance:
Exit Confirmation Dialog
Customize the confirmation dialog that appears when closing Flatfile:Error Component
Customize the error display component:Basic Behavior
Advanced Configuration Options
These options provide specialized functionality for custom implementations:Space Reuse
Important: To reuse an existing space, you must retrieve the spaceId and access token server-side using your secret key, then pass the
accessToken to the client. See Server Setup Guide for details.
UI Overrides
On-Premises Configuration
URLs for other regions can be found here.
Configuration Examples
Basic Space Creation
Space Reuse with Access Token
Advanced UI Customization
Troubleshooting
Invalid publishableKey
Error:"Invalid publishable key"
Solution:
- Verify key starts with
pk_ - Check for typos or extra spaces
- Ensure key is from correct environment
Space Not Found
Error:"Space not found" or 403 Forbidden
Solution:
- Verify Space ID format (
us_sp_prefix) - Ensure Space exists and is active
- Check Space permissions in dashboard
CORS Issues
Error:"CORS policy blocked"
Solution:
- Add your domain to allowed origins in Platform Dashboard
- Ensure you’re using publishable key (not secret key)
- Check browser network tab for specific CORS errors
Access Token Issues
Error:"Invalid access token" when using space reuse
Solution:
- Ensure access token is retrieved server-side using secret key
- Check that token hasn’t expired
- Verify space ID matches the token
Testing Setup
For development and testing:Next Steps
Once configured:- Deploy your event listener to Flatfile
- Configure data validation and transformation rules
- Test the embedding in your application
- Deploy to production with production keys

