A valid request URL is required to generate request examples{
"success": true,
"data": {
"id": "key_3f9a12",
"name": "Production backend",
"prefix": "flowyte_sk_live_9x",
"last4": "a1b2",
"scopes": [
"agents:read",
"calls:read"
],
"env": "live",
"expiresAt": "2027-01-01T00:00:00.000Z",
"createdBy": "user_2a1b9c",
"createdAt": "2026-07-12T09:00:00.000Z",
"token": "flowyte_sk_live_9x7Qp2fV8kR3nT6mB1sD4wH0aXcY5eZ_a1b2"
}
}{
"type": "about:blank",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"errors": [
{
"field": "<string>",
"message": "<string>"
}
]
}{
"type": "about:blank",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"errors": [
{
"field": "<string>",
"message": "<string>"
}
]
}Create an API key (token shown once)
Create a secret API key scoped to the actions you choose. The full token (flowyte_sk_…) is returned ONLY in this response and is never recoverable — store it immediately. Pick env:'live' for real traffic or env:'test' for a sandbox key, and grant the narrowest scopes the integration needs. Optionally set expiresAt to auto-expire the key.
A valid request URL is required to generate request examples{
"success": true,
"data": {
"id": "key_3f9a12",
"name": "Production backend",
"prefix": "flowyte_sk_live_9x",
"last4": "a1b2",
"scopes": [
"agents:read",
"calls:read"
],
"env": "live",
"expiresAt": "2027-01-01T00:00:00.000Z",
"createdBy": "user_2a1b9c",
"createdAt": "2026-07-12T09:00:00.000Z",
"token": "flowyte_sk_live_9x7Qp2fV8kR3nT6mB1sD4wH0aXcY5eZ_a1b2"
}
}{
"type": "about:blank",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"errors": [
{
"field": "<string>",
"message": "<string>"
}
]
}{
"type": "about:blank",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"errors": [
{
"field": "<string>",
"message": "<string>"
}
]
}Authorizations
Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.
- Token URL
- /api/v1/api-keys
Body
Human label to identify the key later (e.g. "Production backend").
The permissions this key grants — keep it to the narrowest set the integration needs.
Frozen scope strings.
agents:read, agents:write, knowledge:read, knowledge:write, skills:read, skills:write, playbooks:read, playbooks:write, guardrails:read, guardrails:write, numbers:read, numbers:write, sms:read, sms:write, sms:send, outbound:read, outbound:write, integrations:read, integrations:write, integrations:connect, calls:read, billing:read, billing:write, analytics:read, analytics:write, audit:read, webhooks:write, keys:write, chat:read, chat:write, chat:public, widgets:read, widgets:write, pubkeys:read, pubkeys:write, phone:read, phone:write, presence:write, team:read, team:write, escalation_destinations:read, escalation_destinations:write, escalation_policies:read, escalation_policies:write, escalations:read, escalations:claim, escalations:respond, escalations:resolve live for real production traffic, test for a sandbox key that never touches billable resources.
live, test Optional expiry (RFC3339). After this time the key stops authenticating. Omit for a non-expiring key.