Token Authentication

The token in an API Key is used to authorize invokes of Workflows. See Workflow API.

Creating and Managing Tokens

Open API Keys from the main navigation.

Create an API Key and select Service token. See API Keys screen for every field and action.

Name

Provides a recognizable name for the key. When invoked using a key, the Context Property (v2 Runtime) or InitData Property (v1 Runtime), included in the Start Node Workflow Log indicates the key that was used in the form Token-based Key: your-key-name in the Username element.

Enabled

Keys can be disabled as necessary. Cached authorization data can delay the change for up to five minutes.

Target Site Environment

Select the Site Environment against which the key can authorize requests. The request hostname selects the Environment and must match the key's target Environment. A key cannot be shared across Site Environments.

Primary and Secondary Keys

Contains the generated secrets. They are displayed only when first generated or regenerated. Copy them immediately and store them securely. Use the two independent values to rotate the API Key without intentionally interrupting consumers.

Permitted Workflows

Select the Workflows that this key may invoke. The key cannot invoke a Workflow that is not assigned to it.

Specifying a Key in an API call

API Keys can be provided via a querystring or via the Authorization HTTP Header.

Add the following header to your request:

Authorization: Bearer your-auth-key

Append the querystring auth-key to the request URL. For example, if you are invoking this Workflow:

https://mycompany.flowgear.net/customers/123/

Provide the API Key like this:

https://mycompany.flowgear.net/customers/123/?auth-key=your-auth-key

Note that we do not recommend using this technique, because it is possible that the URL will be logged.