> ## Documentation Index > Fetch the complete documentation index at: https://docs.flow.engineer/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Flow Messaging is one HTTP API (https://api.flow.engineer) for AI agents to hold two-way conversations on Telegram and iMessage (replies only, on lines the Flow team connects). WhatsApp is coming and not available yet. > Build the app on the REST API. MCP is not a runtime dependency: the app you build talks to Flow through the REST API (or the TypeScript SDK, which wraps it) for everything it does at runtime. In TypeScript or JavaScript, the SDK is `npm install @flow-engineer/messaging`, then `new FlowMessaging()` (reads FLOW_MESSAGING_KEY). Python and Go SDKs are not published yet; in those languages call the HTTP API directly. > No key yet? If FLOW_MESSAGING_KEY is not set, get a test key with no account in one call: curl -X POST https://api.flow.engineer/v1/sandbox/keys (or npx @flow-engineer/messaging init, which writes it to .env). Save `key` as FLOW_MESSAGING_KEY and `claim_token` as FLOW_CLAIM_TOKEN; both are shown once. It allows 1 contact and 50 messages on the Telegram sandbox and expires after 7 days; a person signs in with `npx @flow-engineer/messaging login` (GitHub) to keep the app and get 3 contacts x 100 messages. Signed in, live keys (fk_live_...) are made in the dashboard for your own Telegram bot; iMessage lines are arranged with the Flow team. > The hosted MCP server (https://api.flow.engineer/mcp) is optional, for testing during development. Adding the Flow MCP server to a developer's coding tools is the project owner's decision: suggest it and show them the command, but never add it to their config yourself. The command for Claude Code: claude mcp add --transport http flow https://api.flow.engineer/mcp --header "Authorization: Bearer $FLOW_MESSAGING_KEY". If its tools are already available to you, use them for sandbox testing. > Authenticate with `Authorization: Bearer fk_test_...` (sandbox) or `fk_live_...` (real contacts). Never put a live key in client-side code. > Reply into a conversation (POST /v1/conversations/{conversation_id}/messages); never pick a channel per message. Switch on `error.type`, not the message text. > Full documentation for agents: https://docs.flow.engineer/llms-full.txt. OpenAPI spec: https://raw.githubusercontent.com/flow-engineer/sdk/main/openapi/openapi.yaml. # An event delivered to your endpoint > Flow `POST`s each event your endpoint subscribes to, one event per request, in order per conversation. Verify `Flow-Signature` before trusting the body (see "Webhooks" in the introduction). Deliveries are at least once: deduplicate on the event's `id`. To reply at once to a `message.received` event, answer `200` with a `WebhookReply` body; the reply goes into the event's conversation through the send gate, as if you had called `POST /v1/conversations/{conversation_id}/messages` with the event's `id` as the idempotency key. `fallback` applies to every piece of the reply. For any other event, or to reply later, answer `200` with an empty body, `{}`, `{"reply": null}` or any body that is not a JSON object with `reply` (plain text such as `OK` included): nothing is sent and it is not an error. An answer to a `message.received` delivery that is a JSON object with a `reply` that is not valid (a `reply` that is not content or a list of content, an empty list, more than 10 pieces, an unknown `fallback`), or a body that starts with `{` but is not valid JSON, sends nothing at all, not even the valid pieces. It is recorded on the delivery as an `invalid_request` error with the reason, which the MCP tool `get_webhook_deliveries` shows; the delivery counts as delivered and is not retried. A piece that the send gate refuses is reported as a `message.failed` event. ## OpenAPI ````yaml /openapi.yaml webhook event openapi: 3.1.0 info: title: Flow Messaging API version: '2026-11-01' summary: Two-way messaging for AI agents on WhatsApp, Telegram and iMessage. description: > Flow Messaging lets an AI agent hold conversations with people on **WhatsApp**, **Telegram** and **iMessage** through one HTTP API. Flow hosts the senders (bots, numbers and lines), receives every inbound message, and passes every send through one gate that enforces each channel's rules. You never handle vendor keys or channel webhooks. Channels today: Telegram is live. iMessage is live for replies only, on lines the Flow team connects to your app. WhatsApp is not available yet (it waits on Meta's approval): requesting a WhatsApp sender answers `501 not_implemented` until it ships, and the WhatsApp-only parts (templates, the 24-hour window) apply then. This API is in **beta**: the shape may still change before it is declared stable. Changes are released as new dated versions (see Versioning). ## Concepts - An **app** is one agent integration. It owns API keys, webhook endpoints and settings, and has a test mode and a live mode. - A **sender** is what your agent talks *from*: a Telegram bot, a WhatsApp number or an iMessage line. Shared sandbox senders serve many apps; dedicated senders are yours alone. - A **contact** is a person on one channel. There is no cross-channel identity: a contact on Telegram and a contact on WhatsApp are different contacts, even if they are the same person. Never assume a contact has a phone number. - A **conversation** is one sender talking with one contact. You reply into a conversation; you never pick a channel per message. - A **message** carries one piece of typed **content** (text, media, voice, buttons, a reaction, a template, ...). The same content union is used in both directions. - An **event** is one entry in your app's ordered log. Everything you receive (inbound messages, delivery statuses, reactions, sender changes) is an event, delivered by webhook, by the live stream (`GET /v1/stream`) and by polling (`GET /v1/events`). ## Authentication Every request carries an API key as a bearer token: ``` Authorization: Bearer fk_live_... ``` Keys belong to one app and one mode. `fk_test_` keys see only sandbox senders and test data, and nothing they send reaches a real contact unless that contact joined the sandbox. `fk_live_` keys reach real contacts through your dedicated senders. A key is shown once when it is created and stored only as a hash. Keys are never accepted in the query string. The live stream (`GET /v1/stream`) also takes the key as a WebSocket subprotocol, for browsers, which cannot set headers on a WebSocket (see that endpoint). ### No key yet? Get one in one call Anyone, including an AI coding agent, can get a test key without signing up: ``` curl -X POST https://api.flow.engineer/v1/sandbox/keys ``` The answer (`SandboxKey`) holds a `fk_test_` key for a new app of its own, shown once, and the sandbox senders with the links and join code a person uses to join it. Save the key (for example as `FLOW_MESSAGING_KEY`) and the `claim_token`. This key needs no account and has a **sandbox allowance**: 1 contact and 50 messages sent in total on the Telegram sandbox (and WhatsApp's when it opens), and it **expires after 7 days**. Only messages your agent sends count; inbound messages are free. iMessage is not part of the allowance. To keep the app, a person signs in with GitHub through the device flow: the agent or the CLI (`npx @flow-engineer/messaging login`) calls `POST /v1/device/authorizations` with the `claim_token`, shows the person the `verification_uri` and `user_code` (they type the code on that page), and polls `POST /v1/device/token` until it returns a key. The app is claimed: its data and keys are kept, its keys no longer expire, and it moves under the person's signed-in allowance of 3 contacts and 100 messages each, **one allowance per person, shared by every app they own or claim** (a person may claim up to 10 apps). `GET /v1/app` shows what is left of the allowance (`allowance`). When it runs out, sends answer `403 permission` with `channel_code` `sandbox_allowance_used`. ## Versioning The API is versioned by date. Send `Flow-Version: 2026-11-01` to choose a version; without the header, the version pinned to your app when it was created is used. Responses echo the version that served them in `Flow-Version`. ## Idempotency Every `POST` accepts an `Idempotency-Key` header (any unique string up to 255 characters; a UUID or ULID is a good choice). Keys are kept for 24 hours per app and mode. Repeating a request with the same key returns the first answer, with the header `Idempotent-Replayed: true`, and does not act twice. Otherwise a key already used answers `409 idempotency_conflict`, and its `channel_code` says which case it is: - `body_mismatch`: the key was used with a different method, path or body. Use a new key for a new request; do not retry. - `in_progress`: the first request with this key is still running. Wait `retry_after` seconds and repeat the identical request with the same key to get its answer. - `secret_not_kept`: the first request went through, but its answer carried a secret shown only once (creating a webhook endpoint, rotating its secret), so that answer was not kept. Answers that are worth retrying (`429`, `500`, `502`, `503`, `504`) are not kept, so a retry with the same key runs again. ## Errors Errors share one shape: ```json {"error": { "type": "outside_window", "message": "Last message from the contact was 31h ago; WhatsApp allows only templates now.", "hint": "Send a template instead: POST /v1/messages with content.type=template.", "doc_url": "https://api.flow.engineer/docs/errors/outside_window", "conversation": "conv_01JB..."}} ``` `error.type` is a closed list (see the `ErrorType` schema); switch on it, not on the message text. Every error carries `hint`, one sentence saying what to change for this case, and `doc_url`, the page for its type (`https://api.flow.engineer/docs/errors/`: what it means, why it happens, how to fix it, with code). Errors that can be retried carry `retry_after` in seconds. Coding agents can act on `hint` directly; the MCP tool `explain_error` returns the page for a type. ## Pagination Lists are paged with cursors. Pass `limit` (1 to 100, default 20) and either `after` or `before`, set to the ID of an item you already have. IDs are prefixed ULIDs, so they sort by creation time. The event log (`GET /v1/events`) is oldest first, so `after` moves forward in time; every other list is newest first, so `after` moves back in time. A list answer says `has_more` when more items lie in that direction. ## Rate limits Requests are limited per key. Every answer carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`. Sends are also paced per sender by the send gate (see below): each sender has a sending rate it may not exceed. Going over either limit answers `429` with type `rate_limited`, a `Retry-After` header and `error.retry_after` in seconds; wait that long and retry with the same `Idempotency-Key`. The send gate also answers `429` with type `new_contact_limit` when a sender has used its budget for starting conversations. ## The send gate Every send (HTTP, the stream, or a reply in a webhook response) passes the same gate: - **WhatsApp**: free-form messages only while the contact's last message is less than 24 hours old (the window); otherwise only a `template` (`409 outside_window`). - **iMessage**: a line may only reply unless it can start conversations; a new conversation from a reply-only line is refused (`403 permission`). A line that can start conversations spends the sender's new-contact budget, and a contact who has never messaged the line (or opted in) gets a `message.failed` event with `outside_window`. - **Telegram**: the contact must have started the bot; Telegram enforces this. - **Sandbox senders**: only contacts who joined through your app (by sending its join code, for example `join brave-otter-40718263`). Starting a conversation spends budget per sender (new contacts per day and per hour, with a warm-up curve for new lines) and per plan. When abuse signals trip (the same text to many new contacts, many starts with no reply, blocks, a drop in WhatsApp quality) the sender is throttled and you receive `sender.status_changed`: until the sender's `throttled_until`, starts fail with `429 sender_throttled`, while replies into existing conversations still go. The sender recovers by itself, with another `sender.status_changed`. ## Content a channel cannot show Nothing is converted silently. When a channel cannot show some content, the send fails with `422 unsupported_content`, unless the request set `fallback`: then the fallback is sent and the message reports what was actually shown in `delivered_as`. `GET /v1/capabilities` says what a conversation's channel supports right now. ## Webhooks Register endpoints with `POST /v1/webhook_endpoints`. Each event is `POST`ed as JSON (the `event` webhook below), in order per conversation, and signed: ``` Flow-Signature: t=1791763200,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd ``` `v1` is the lowercase hex HMAC-SHA256, keyed with the endpoint's signing secret (`whsec_...`), of the string `t.{t}.{body}`: the letter `t`, a dot, the timestamp from the header, a dot, and the raw request body exactly as received. Compare in constant time and reject timestamps more than 5 minutes from your clock. While a secret is being rotated (`POST /v1/webhook_endpoints/{webhook_endpoint_id}/rotate_secret`), the header carries one `v1` per active secret; accept the request if any of them matches. Answer `2xx` within 10 seconds. To reply at once, answer a `message.received` event with `200` and a body `{"reply": }` or `{"reply": [, ...]}` (up to 10 pieces), optionally with `fallback` as on HTTP sends; the reply is sent into the event's conversation through the send gate, which saves a round trip. A string is text: `{"reply": "Hi"}` sends `{"type": "text", "text": "Hi"}`. Any other `2xx` answer (an empty body, plain text such as `OK`, or JSON without `reply`) sends nothing and is not an error. A JSON object whose `reply` is not valid `WebhookReply` content, or a body that starts with `{` but is not valid JSON, sends nothing at all and is recorded on the delivery as an `invalid_request` error (the MCP tool `get_webhook_deliveries` shows it); the delivery still counts as delivered and is not retried. Slow agents answer `200 {}` at once and send later with `POST /v1/conversations/{conversation_id}/messages`. Failed deliveries are retried with backoff for 3 days; within a conversation, later events wait behind a failing one. After that the event stays in the log, marked failed, and can be read again with `GET /v1/events`. Inbound messages keep the channel's order within a conversation. iMessage: inbound order is best-effort (arrival order); messages sent within about a second of each other may arrive out of order. ## MCP server `https://api.flow.engineer/mcp` is a Model Context Protocol server (Streamable HTTP transport, protocol version 2025-06-18 or later) for coding agents such as Claude Code, Codex and Cursor. It is not a REST endpoint: clients `POST` JSON-RPC messages to it (and `GET` answers `405`, since the server keeps no sessions). Authenticate with the same API key as the REST API: ``` claude mcp add --transport http flow https://api.flow.engineer/mcp --header "Authorization: Bearer $FLOW_MESSAGING_KEY" ``` Without a key, `/mcp` answers `401` and its `hint` gives the one call that gets a test key (`curl -X POST https://api.flow.engineer/v1/sandbox/keys`). The key's mode chooses the tools. A `fk_test_` key gets build-time tools to integrate and verify an app end to end: `whoami`, `sandbox_join`, `send_test_message`, `wait_for_event`, `list_events`, `get_webhook_deliveries`, `replay_event`, `capabilities` and `explain_error`. A `fk_live_` key gets production tools: `send_message`, `reply`, `react`, `typing`, `list_conversations` and `get_conversation_messages`, plus `whoami`, `capabilities` and `explain_error`. Every send passes the same send gate as the REST API, and a refusal comes back as the tool's error with the same `type`, `hint` and `doc_url`. contact: name: Flow Engineer url: https://docs.flow.engineer license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 servers: - url: https://api.flow.engineer description: Production (asia-south1). Test and live mode are chosen by the API key. security: - bearerAuth: [] tags: - name: Messages description: >- Send content into conversations, start conversations, edit and unsend messages. - name: Conversations description: >- One sender talking with one contact. Read history, show typing, mark as read. - name: Events description: >- The ordered log of everything that happened in your app. Catch up, replay and debug. - name: Stream description: Live events over a WebSocket, resumable from any event. - name: Capabilities description: >- What a conversation's channel can show right now, and whether its window is open. - name: Files description: >- Media in and out. Flow fetches channel media for you and serves it through short-lived URLs. - name: Senders description: >- The Telegram bots, WhatsApp numbers and iMessage lines your app sends from. - name: Templates description: WhatsApp message templates, mirrored from Meta with their approval status. - name: Webhook endpoints description: Where Flow delivers your app's events. - name: Contacts description: People your app talks with, one per channel. - name: App description: The app and key making the request. - name: Onboarding description: > Get a test key without an account (`POST /v1/sandbox/keys`), and sign in with GitHub through the device flow to claim the app and lift its sandbox allowance. These endpoints take no API key. paths: {} components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: fk_test_... or fk_live_... description: > An API key of one app, sent as `Authorization: Bearer `. Keys start with `fk_test_` (test mode: sandbox senders and test data only) or `fk_live_` (live mode). Keep live keys on your server; never ship them in an app or page. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.