API Key
An API Key defines who or what may invoke a selected set of Workflows in one Site Environment.
Workflows invoked through the Workflow API are authenticated with an API Key. The Environment specified on the API Key must match the Environment selected by the invoked hostname; see Site Settings.
API Key types
Flowgear supports these API Key types for new keys:
- Service token authenticates a system or external client that invokes Workflows through the REST API. Flowgear creates independent primary and secondary secret values.
- Cookie authorizes selected Site users to invoke selected Workflows through their authenticated Flowgear Console session. Flowgear Apps use this model for embedded invocation.
- Delegate MCP user authorizes selected Site users to invoke selected MCP-enabled Workflows through Flowgear's Workflow MCP server. This option is available only when the Site's subscription supports MCP server access.
Certificate and legacy Basic keys can appear in the API Keys list for existing Sites. They cannot be selected when creating a key and should not be used for new integrations.
Scope and authorization
Every API Key has:
- A name.
- An enabled or disabled state.
- One target Environment.
- A set of permitted Workflows.
- A set of permitted users when the type is Cookie or Delegate MCP user.
The key type and target Environment cannot be changed after the key is created. Create a replacement key when either value must change.
Disabling a key prevents it from authorizing new invocations after the runtime's cached authorization data refreshes. Deleting a key permanently removes the authorization record and, for service-token keys, its stored secrets.
Service-token secrets
Cookie and Delegate MCP API Keys do not include a token because these uses are authenticated by Flowgears auth model for Cookie or MCP's model for Delegate MCP. For these key types, the API key associates a set of Workflows with the set of Users who are allowed to invoke them in the context of the specified Environment.
For other key types, Flowgear generates a primary and a secondary secret when an API Key is first saved. Both secrets authorize the same key, Environment, and Workflows.
The secret values are displayed only immediately after creation or regeneration. Copy them before leaving the page and store them in a secure secret manager. Flowgear stores protected representations for validation and cannot display the existing values again.
The two secrets support rotation - move consumers from one secret to the other, regenerate the unused secret, and then complete the transition. See Rotate an API Key.