Cookie-based Authentication | API | Flowgear Help Center

An API Key with type Cookie authorizes embedded Flowgear App calls for selected users and Workflows in one Environment.

The App invokes a relative HTTP Workflow path through Flowgear.Sdk.invoke in the Flowgear App SDK. The Console makes the request using the signed-in session, target Environment, and matching Cookie-key authorization. Frontend code does not receive or store an API-key secret.

Authorization requires all of these conditions:

The App user is signed in to Console.
The Cookie API Key targets the selected Environment and is enabled.
The key permits that user and Workflow.
The user has effective Environment access when scoped permissions are enabled.
The Workflow is published and enabled in that Environment.

Cookie authentication is for the embedded Console bridge. A standalone browser App will need to safely handle the API Key it uses to invoke Workflows instead.

See App Security Model, API Keys Screen, and App Console SDK.