The machine API is authenticated with a workspace-scoped API key. Create one from Settings → API Keys — keys are shown once at creation time and only a masked prefix is stored after that, so save it somewhere safe.

Send it as a bearer token or a dedicated header — either works:

Authorization: Bearer fl_live_YOUR_API_KEY
# or
X-Api-Key: fl_live_YOUR_API_KEY

A key is bound to exactly one workspace and has full access to that workspace's /v1 API — there are no per-key scopes to choose. See API keys.

No credential at all fails with 401 NO_SESSION. A key that isn't fl_live_… or fl_test_…-prefixed is treated as absent rather than rejected outright. Only a recognized-prefix key that's unknown or revoked fails with 403 INVALID_API_KEY — a deliberate choice so scanning for valid key prefixes can't be distinguished from any other rejection. A key on a suspended subscription fails with 403 SUBSCRIPTION_SUSPENDED.

A key can also be created with an fl_test_… prefix. The env is an organizational label only — a test key behaves identically to a live one, with the same access and the same auth rules above.

Embed sessions

Routes under /v1/embed/* use a different credential: a short-lived embed session bearer token, minted by POST /v1/embed/:embedId/session — not an fl_live_… key. See Embed.