Create an API key (token shown once)
Create a secret API key scoped to the actions you choose. The full token (flowyte_sk_…) is returned ONLY in this response and is never recoverable — store it immediately. Pick env:'live' for real traffic or env:'test' for a sandbox key, and grant the narrowest scopes the integration needs. Optionally set expiresAt to auto-expire the key.
Authorizations
Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.
Body
Human label to identify the key later (e.g. "Production backend").
The permissions this key grants — keep it to the narrowest set the integration needs.
Frozen scope strings.
agents:read, agents:write, knowledge:read, knowledge:write, skills:read, skills:write, playbooks:read, playbooks:write, guardrails:read, guardrails:write, numbers:read, numbers:write, sms:read, sms:write, outbound:read, outbound:write, integrations:read, integrations:write, integrations:connect, calls:read, billing:read, billing:write, analytics:read, analytics:write, audit:read, webhooks:write, keys:write, chat:read, chat:write, chat:public, widgets:read, widgets:write, pubkeys:read, pubkeys:write, phone:read, phone:write, presence:write, team:read, team:write, escalation_destinations:read, escalation_destinations:write, escalation_policies:read, escalation_policies:write, escalations:read, escalations:claim, escalations:respond, escalations:resolve live for real production traffic, test for a sandbox key that never touches billable resources.
live, test Optional expiry (RFC3339). After this time the key stops authenticating. Omit for a non-expiring key.