Developer tools

Create an API key

Create a restricted server credential with an expiry or an explicit service-account exception. Store the secret from the first response securely.

POST/v1/api-keys

Administrator or Sandbox developer requiredUser token only. Integration keys cannot authorize this operation.

How it works

Expiry: 1–365 days, default 30. Set expiresInDays to null only with an active serviceAccountId to issue a key without expiration. Such keys remain valid until revoked; restrict their permissions and replace them regularly. Maximum 200 records per workspace including revoked keys. Secrets are never replayed. Revoke and replace lost keys.

Set serviceAccountId for organization-owned keys. Every requested scope must fit the active account permission ceiling; users:invite always requires a service account. Secrets are shown once. Create a second key and revoke the first for rotation.

Request body

namestringrequiredmin length 1 · max length 80

scopesarrayrequiredmin items 1 · max items 7

serviceAccountIdstringoptionaluuid

expiresInDaysintegeroptionalmin 1 · max 365 · default 30

Required fields & full validation schema → OpenAPI

Request essentials

Authorization: Bearer $FLOW2ACT_ACCESS_TOKEN
X-Organization-Id: Your workspace UUID
Idempotency-Key: Stable per operation; 8–128 characters

Have an implementation question?Ask about this endpoint. Answers include source references.

curl -X POST "https://api.flow2act.com/v1/api-keys" \ -H "authorization: Bearer $FLOW2ACT_ACCESS_TOKEN" \ -H "x-organization-id: 10000000-0000-4000-8000-000000000001" \ -H "idempotency-key: example-create-key-001" \ -H "content-type: application/json" \ --data-raw '{ "name": "Deployment integration", "scopes": [ "runs:start", "runs:read", "flows:read" ], "expiresInDays": 30, "serviceAccountId": "10000000-0000-4000-8000-000000000010" }'

Developer tools

Create an API key

Create a restricted server credential with an expiry or an explicit service-account exception. Store the secret from the first response securely.

POST/v1/api-keys

Administrator or Sandbox developer requiredUser token only. Integration keys cannot authorize this operation.

How it works

Request body

namestringrequiredmin length 1 · max length 80

scopesarrayrequiredmin items 1 · max items 7

serviceAccountIdstringoptionaluuid

expiresInDaysintegeroptionalmin 1 · max 365 · default 30

Required fields & full validation schema → OpenAPI

Request essentials

Authorization: Bearer $FLOW2ACT_ACCESS_TOKEN
X-Organization-Id: Your workspace UUID
Idempotency-Key: Stable per operation; 8–128 characters

Have an implementation question?Ask about this endpoint. Answers include source references.

Create an API key

How it works

Request body

Request essentials

Ask the docs

Create an API key

How it works

Request body

Request essentials

Ask the docs