API Keys

Manage your API keys

Create a long-lived API key for your Flowie organization, list the keys that already exist, and revoke any you no longer need — all from this page. Sign in with the same Flowie account you use for the dashboard; the key inherits your organization and tier. Keys minted here are also remembered locally so the Playground and API reference Try-it widgets can pick them from a dropdown.

Where the key works

A key belongs to the environment it was created on — https://back.flowie.ink/exchange (staging) or https://back.p2p-flowie.com/exchange (production). These are separate backends with separate keys: a staging key returns 401 on production and vice-versa. Pick the environment in the form below before creating. Pass the key as Authorization: Bearer flw_…. Note the prefix is the mode, not the environment: flw_live_… = live mode, flw_test_… = sandbox mode — both exist on staging and production, so the prefix alone does not tell you which environment a key is for. The full string is shown once, right after creation — save it in your secret store before navigating away (we also cache it in this browser's localStorage so the Playground can reuse it).

Sign in to manage your API keys

If you're already signed in to Flowie in another tab, we'll detect it automatically. Otherwise, open the dashboard, sign in, then come back here.

Or paste a Flowie JWT manually

Paste an access_token from your Flowie session (DevTools → Application → Local Storage → look for an @@auth0spajs@@::… entry on staging.flowieapp.io, or grab a Bearer … header from a Network request). Stored only in this browser's localStorage.

No account? Sign up for free — under a minute, then come back here.

Create a new key

✓ Key created. Copy it now — you will not see the full value again.

Your keys

Name	Env	Prefix	Company	Created	Expires

No API keys yet. Create one above to get started.

How it works

This page calls the same public endpoints documented in the API reference. Nothing happens server-side that you couldn't reproduce with curl:

Create → POST /v1/api-keys with {"name": "...", "companyId": "..."}.
List → GET /v1/api-keys (paginated; this page reads the first 100).
Revoke → DELETE /v1/api-keys/{id} (204 on success). Revocation is immediate; any in-flight request finishes, but the next one returns 401.

Your Flowie JWT is held in localStorage only (key flowie-playground-state.key). It never leaves the browser except as an Authorization: Bearer … header to the Exchange API. If you belong to multiple organizations, use the organization picker in the topbar to choose which one a new key targets — the picker sets the X-Flowie-Organization-Id header on every request.

The page detects your existing Flowie session via a hidden iframe (/__exchange-handshake.html) hosted on staging.flowieapp.io (or app.flowie.me in production). The iframe reads the Auth0 SDK's cached access token from the dashboard's localStorage and posts it back via postMessage — strict origin validation, no servers, no cookies. If you're not signed in there, the page falls back to the dashboard sign-in link or manual JWT paste.