Authentication: API keys, abilities, and environments
How Flowyn API keys authenticate requests, how test and live environments are separated, what read, run, and reveal abilities allow, and how to rotate keys.
How Flowyn authenticates requests
Every request carries Authorization: Bearer <key>. The key determines the workspace and the environment. The API does not use cookies.
curl https://api.flowyn.dev/v1/jobs \
-H "Authorization: Bearer flw_test_••••"Test and live environments
| Prefix | Environment | Behaviour |
|---|---|---|
| flw_test_ | Test | Resources are separate from live. Use it while you build. |
| flw_live_ | Live | Production traffic. Counts against the plan allowance. |
Abilities
A key can be limited to some abilities. A key created without a choice has all three.
| Ability | Allows |
|---|---|
| read | GET requests. |
| run | Creates and actions, such as sending events, creating jobs, recording agent runs, and testing a provider connection. Includes read. |
| reveal | Everything, including changes that store or rotate secrets, such as provider connections and endpoint signing secrets. |
Reveal-once keys
A key is shown once when it is created. Flowyn stores only a hash. If a key is lost, create a new one and revoke the old one, or rotate it from the dashboard or with POST /v1/api-keys/{id}/rotate.
Where keys belong
Server-side only: a backend, a server function, a worker, an agent runtime, or a CI secret. A key in browser or mobile code can be extracted.
Errors
| Status | type | Meaning |
|---|---|---|
| 401 | unauthorized | Missing, malformed, or revoked key. |
| 403 | forbidden | The key lacks the ability the call needs (ability_required). |