How it works
Send Authorization: Bearer $FLOW2ACT_API_KEY. Administrators create expiring keys under API keys. Secrets are shown once, stored only as SHA-256 hashes and cannot be recovered. Keep them on your server.
Use POST /v1/auth/token to sign in without a browser, or use your normal flow2act web sign-in. Both issue FLOW2ACT_ACCESS_TOKEN. flow2act manages authentication; no separate identity-provider setup is required. Interactive actions use this access token, not an ID token. Key management, group linking, AI, billing, inbox and decisions require a signed-in flow2act user. Integration keys can never approve requests.
Keys are workspace-bound, expire after 1–365 days and can be revoked for subsequent requests. Keys with serviceAccountId are organization-owned and stay valid when the creator leaves; disabling the service account invalidates all its keys. Legacy keys without serviceAccountId are invalidated when their creator membership is deactivated. Revoke keys explicitly during offboarding.
Workspace access requires an enrolled authenticator. Complete /security in the browser first. Every API request validates the token online and refreshes group membership. Sign-out revokes all current Cognito sessions. API sign-in may return a standard MFA challenge.
Request essentials
- Authorization
- Bearer $FLOW2ACT_API_KEY
- X-Organization-Id
- Your workspace UUID