> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowra.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate to the Flowra API with project API keys, and optionally scope requests with x-username.

Flowra API endpoints that support API key authentication accept your **project API key** via header. Keys are scoped to one project.

## Create an API key

<Steps>
  <Step title="Open the dashboard">
    Go to [Flowra Dashboard](https://flowra.dev) and sign in.
  </Step>

  <Step title="Select a project">
    Use the sidebar project switcher, or create a project first. See [Projects and API keys](/product/projects-and-keys).
  </Step>

  <Step title="Create the key">
    Open **Project → API Keys** (or the API keys tab in project settings). Create a key, name it (for example `Backend prod`), and copy it once. You will not see the full value again.
  </Step>
</Steps>

### Best practices

* Use separate keys for development, staging, and production
* Name keys by where they are used (for example `CI`, `Backend prod`)
* Rotate by creating a new key, updating the app, then revoking the old one
* Revoke immediately if a key is exposed

## Send the key

### Option 1: x-api-key header (recommended)

```bash theme={null}
curl -X GET "https://flowra.dev/api/v1/users/profile" \
  -H "x-api-key: YOUR_API_KEY"
```

### Option 2: Authorization Bearer

```bash theme={null}
curl -X GET "https://flowra.dev/api/v1/users/profile" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

### Optional: x-username header

For endpoints that support it, send **x-username** to act as an end user (external user) inside your project — for example in multi-tenant apps. See [Multi-tenancy](/guides/multi-tenancy).

```bash theme={null}
curl -X GET "https://flowra.dev/api/v1/external-users" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-username: end_user_alice"
```

## Which endpoints use API keys?

Endpoints marked with the `x-api-key` security scheme in the [API reference](/api-reference). Examples include tools, auth configs, connected accounts, workflows, triggers, LLM, MCP, skills, and sandbox.

## Security

<Warning>
  Do not expose API keys. Do not commit them to version control, log them, or send them from client-side or public apps. Use environment variables or a secrets manager.
</Warning>

## Next steps

* [SDKs](/guides/sdk) — TypeScript and Python clients (preferred for backends)
* [Quickstart](/quickstart) — First request
* [Multi-tenancy](/guides/multi-tenancy) — Project vs end-user scoping
* [API reference](/api-reference)