Skip to main content
Flowra API endpoints that support API key authentication accept your project API key via header. Keys are scoped to one project.

​
Create an API key

1

Open the dashboard

Go to Flowra Dashboard and sign in.
2

Select a project

Use the sidebar project switcher, or create a project first. See Projects and API keys.
3

Create the key

Open Project → API Keys (or the API keys tab in project settings). Create a key, name it (for example Backend prod), and copy it once. You will not see the full value again.

​
Best practices

  • Use separate keys for development, staging, and production
  • Name keys by where they are used (for example CI, Backend prod)
  • Rotate by creating a new key, updating the app, then revoking the old one
  • Revoke immediately if a key is exposed

​
Send the key

​
Option 2: Authorization Bearer

​
Optional: x-username header

For endpoints that support it, send x-username to act as an end user (external user) inside your project — for example in multi-tenant apps. See Multi-tenancy.

​
Which endpoints use API keys?

Endpoints marked with the x-api-key security scheme in the API reference. Examples include tools, auth configs, connected accounts, workflows, triggers, LLM, MCP server management, skills, and sandbox.

​
MCP clients

Cursor, Claude, and other MCP clients can sign in with OAuth instead of a project API key. Add https://mcp.flowra.dev/mcp with no headers. The client opens Flowra sign-in; you pick a project. The CLI uses the same sign-in: flowra login. See MCP and Use MCP in Cursor. MCP runtime also still accepts x-api-key for CI and clients without OAuth. mcp_manager (create/list/update servers from your backend) uses the API key.

​
Security

Do not expose API keys. Do not commit them to version control, log them, or send them from client-side or public apps. Use environment variables or a secrets manager.

​
Next steps