Skip to main content
POST
Error

Authorizations

Authorization
string
header
required

Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.

Path Parameters

agentId
string
required

The agent this resource is scoped to (the UUID returned by createAgent / listAgents).

Body

application/json
name
string
required

Human label for the key (e.g. "Marketing site").

allowedOrigins
string[]
required

The exact browser origins allowed to load the widget with this key (scheme + host, e.g. https://example.com). Requests from other origins are rejected.

env
enum<string>

live for production embeds, test for a sandbox key.

Available options:
live,
test
rateLimitRpm
integer

Optional per-minute request cap for this key (protects against abuse from a public embed).

requireIdentityVerification
boolean

When true, visitors must pass caller identity verification before the agent will act on sensitive requests.

Response

Created publishable key.

success
boolean
required
data
object
required
message
string
errors
object[]