Authentication
API keys
Manage keys from Settings → API Keys. Any workspace member can view the (masked) key list; creating, renaming and revoking a key is admin-only. Each key has a name, an optional env label (live or test — organizational only, both behave identically).
A key has full access to its workspace's API: every /v1 endpoint, including renders, templates and webhooks. There are no per-key permissions to choose. It is bound to that one workspace and can never act on another.
Treat a key like a password: keep it on your server, never in a browser or mobile app. For anything that runs where users can see it, use an embed session instead — those are limited to what the embed allows. AI agents connect through MCP, where you approve what each agent may do.
The raw key value is shown exactly once, at creation. After that only a masked prefix (e.g.
fl_live_7c2••••••••••3f9a) is ever stored or displayed — if you lose it, revoke it and create a new one.Revoking a key takes effect on its very next request — there is no propagation delay to plan around.
Was this page helpful?