Authentication

Overview

Flowise uses API keys for authentication. API keys allow you to securely access your chatflows and other resources programmatically without exposing your credentials.

API keys are sensitive credentials. Keep them secure and never commit them to version control.

Authentication Methods

Flowise supports the following authentication methods:

Bearer Token Authentication - Primary method for API access
Chatflow-specific API Keys - Scoped access to individual chatflows

Creating an API Key

Via Flowise UI

Log in to your Flowise instance
Navigate to Settings → API Keys
Click Add New
Provide a descriptive name for your key
Select the required permissions
Click Create
Copy the generated API key immediately (it won’t be shown again)

API keys are only displayed once upon creation. Store them securely in a password manager or secure vault.

Via API

You can also create API keys programmatically:

curl -X POST http://localhost:3000/api/v1/apikey \
  -H "Authorization: Bearer YOUR_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "keyName": "My API Key",
    "permissions": [
      "chatflows:view",
      "chatflows:update",
      "predictions:create"
    ]
  }'

Using API Keys

Bearer Token Authentication

Include your API key in the Authorization header using the Bearer scheme:

curl http://localhost:3000/api/v1/chatflows \
  -H "Authorization: Bearer YOUR_API_KEY"

Query Parameter Authentication

For prediction endpoints, you can also pass the API key as a query parameter:

curl -X POST "http://localhost:3000/api/v1/prediction/{chatflowId}?apikey=YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "question": "Hello, how are you?"
  }'

Using API keys in query parameters is less secure as they may be logged in server access logs. Use Bearer token authentication when possible.

API Key Permissions

API keys can be assigned specific permissions to limit their access scope. Common permissions include:

Permission	Description
`chatflows:view`	View chatflows and their configurations
`chatflows:create`	Create new chatflows
`chatflows:update`	Update existing chatflows
`chatflows:delete`	Delete chatflows
`agentflows:view`	View agent flows
`agentflows:create`	Create new agent flows
`agentflows:update`	Update existing agent flows
`agentflows:delete`	Delete agent flows
`predictions:create`	Send messages to chatflows
`apikeys:view`	View API keys
`apikeys:create`	Create new API keys
`apikeys:update`	Update existing API keys
`apikeys:delete`	Delete API keys

Permissions follow a hierarchical structure. The update permission typically includes view access.

Managing API Keys

List All API Keys

Retrieve all API keys in your workspace:

curl http://localhost:3000/api/v1/apikey \
  -H "Authorization: Bearer YOUR_API_KEY"

Update an API Key

Update the name or permissions of an existing API key:

curl -X PUT http://localhost:3000/api/v1/apikey/{keyId} \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "keyName": "Updated Key Name",
    "permissions": [
      "chatflows:view",
      "predictions:create"
    ]
  }'

Delete an API Key

Revoke an API key when it’s no longer needed:

curl -X DELETE http://localhost:3000/api/v1/apikey/{keyId} \
  -H "Authorization: Bearer YOUR_API_KEY"

Deleting an API key is permanent and will immediately revoke access for any applications using that key.

Chatflow-Specific API Keys

Each chatflow can have its own API key for scoped access. To retrieve a chatflow using its specific API key:

curl http://localhost:3000/api/v1/chatflows/apikey/{apikey} \
  -H "Authorization: Bearer YOUR_API_KEY"

Authentication Errors

401 Unauthorized

Occurs when:

API key is missing
API key is invalid or expired
API key doesn’t have permission to access the resource

{
  "error": "Unauthorized access. Please verify your API key."
}

Solution: Verify your API key is correct and has the necessary permissions.

403 Forbidden

Occurs when:

API key is valid but lacks required permissions
Resource is restricted to specific workspace or organization

Solution: Update the API key permissions or contact your administrator.

Best Practices

Use Environment Variables

Store API keys in environment variables, never hardcode them in your source code.

const API_KEY = process.env.FLOWISE_API_KEY;

Rotate Keys Regularly

Periodically rotate your API keys to minimize security risks.

Use Minimal Permissions

Grant API keys only the permissions they need (principle of least privilege).

Monitor Usage

Regularly audit API key usage and revoke unused or compromised keys.

Security Recommendations

Never share API keys - Each application or user should have their own key
Use HTTPS in production - Always use TLS/SSL encryption for API requests
Implement key rotation - Regularly rotate keys and revoke old ones
Monitor for breaches - Set up alerts for unusual API activity
Limit key scope - Use chatflow-specific keys when possible
Store securely - Use secure vaults or secret management services

Example: Complete Authentication Flow

Here’s a complete example of creating an API key and using it to interact with a chatflow:

// Step 1: Create an API key (requires admin access)
const createKeyResponse = await fetch('http://localhost:3000/api/v1/apikey', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ADMIN_TOKEN',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    keyName: 'Production Bot',
    permissions: ['chatflows:view', 'predictions:create']
  })
});

const { apiKey } = await createKeyResponse.json();

// Step 2: Use the API key to send a message
const predictionResponse = await fetch(
  'http://localhost:3000/api/v1/prediction/your-chatflow-id',
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${apiKey}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      question: 'Hello, how can you help me?'
    })
  }
);

const result = await predictionResponse.json();
console.log('AI Response:', result.text);

Overview

Chatflows

Agentflows

Chat Messages

Credentials

Tools & Components

Document Store

API Keys

Overview

Authentication Methods

Creating an API Key

Via Flowise UI

Via API

Using API Keys

Bearer Token Authentication

Query Parameter Authentication

API Key Permissions

Managing API Keys

List All API Keys

Update an API Key

Delete an API Key

Chatflow-Specific API Keys

Authentication Errors

401 Unauthorized

403 Forbidden

Best Practices

Use Environment Variables

Rotate Keys Regularly

Use Minimal Permissions

Monitor Usage

Security Recommendations

Example: Complete Authentication Flow

Next Steps

API Overview

API Reference

Build docs developers (and LLMs) love

Overview

Chatflows

Agentflows

Chat Messages

Credentials

Tools & Components

Document Store

API Keys

​Overview

​Authentication Methods

​Creating an API Key

​Via Flowise UI

​Via API

​Using API Keys

​Bearer Token Authentication

​Query Parameter Authentication

​API Key Permissions

​Managing API Keys

​List All API Keys

​Update an API Key

​Delete an API Key

​Chatflow-Specific API Keys

​Authentication Errors

​401 Unauthorized

​403 Forbidden

​Best Practices

Use Environment Variables

Rotate Keys Regularly

Use Minimal Permissions

Monitor Usage

​Security Recommendations

​Example: Complete Authentication Flow

​Next Steps

API Overview

API Reference

Build docs developers (and LLMs) love

Overview

Authentication Methods

Creating an API Key

Via Flowise UI

Via API

Using API Keys

Bearer Token Authentication

Query Parameter Authentication

API Key Permissions

Managing API Keys

List All API Keys

Update an API Key

Delete an API Key

Chatflow-Specific API Keys

Authentication Errors

401 Unauthorized

403 Forbidden

Best Practices

Security Recommendations

Example: Complete Authentication Flow

Next Steps