Flow.Documentation
ProfessionalAPIs

API keys and permissions (scopes)

5 steps± 4 minVideoVerified 22 Oct 2026
  1. Step 1 · Open your development environment
  2. Step 2 · Issue a key
  3. Step 3 · Without the permission: 403
  4. Step 4 · Grant the permission and try again
  5. Step 5 · Revoke the key

An API key belongs to a department or team, opens only the APIs you tick, has only the permissions (scopes) you name and expires by itself. An endpoint can demand an extra permission. You issue a key without that permission and see 403, add it and see 200, and revoke the key: 401.

Watch the whole guide as a video5 steps in one film
Step 1 / 5

Open your development environment

In the portal, under Environments, click Development, and there Open. Flow opens in a new tab and you are signed in straight away.

  1. Click Development
Open your development environment · Click Development
  1. Click Open ↗
Open your development environment · Click Open ↗
Step 2 / 5

Issue a key

Under Security → API keys click ＋ New key. Give it a name that says for whom and what for, an owner, and tick only the API it may open. Leave permissions empty for now. It expires after the chosen period.

  1. Click Security
Issue a key · Click Security
  1. Click API keys
Issue a key · Click API keys
  1. Click ＋ New key
Issue a key · Click ＋ New key
  1. In Name, type Dealer North → parts
Issue a key · In Name, type Dealer North → parts
  1. Click Parts
Issue a key · Click Parts
  1. Click 90 days
Issue a key · Click 90 days
  1. Click Issue key
Issue a key · Click Issue key
Issue a key · The key, visible once (covered up here).
  1. Click Done, I stored it
Issue a key · Click Done, I stored it
Step 3 / 5

Without the permission: 403

The endpoint demands the permission parts:read. The key does open the API, but lacks that permission: the gateway answers 403 Insufficient scope and the workflow does not run.

  1. Click the endpoint
Without the permission: 403 · Click the endpoint
  1. In Key or token, type ••••••••
Without the permission: 403 · In Key or token, type ••••••••
  1. Click ▶ Send
Without the permission: 403 · Click ▶ Send
Without the permission: 403 · 403: the permission is missing.
Step 4 / 5

Grant the permission and try again

Edit the key and fill in parts:read under Permissions (scopes). The key itself stays the same: the consumer changes nothing. Now the endpoint answers 200.

  1. Click Security
Grant the permission and try again · Click Security
  1. Click API keys
Grant the permission and try again · Click API keys
  1. Click Edit
Grant the permission and try again · Click Edit
  1. In Permissions (scopes), type parts:read
Grant the permission and try again · In Permissions (scopes), type parts:read
  1. Click Save
Grant the permission and try again · Click Save
Grant the permission and try again · The key, now with the permission parts:read.
  1. Click the endpoint
Grant the permission and try again · Click the endpoint
  1. In Key or token, type ••••••••
Grant the permission and try again · In Key or token, type ••••••••
  1. Click ▶ Send
Grant the permission and try again · Click ▶ Send
Grant the permission and try again · 200: key and permission match.
Step 5 / 5

Revoke the key

A consumer stops, or a key leaked? Revoking works at once: every next call gets 401. To replace a key without interruption instead, choose Renew: the old one keeps working for a while.

  1. Click Security
Revoke the key · Click Security
  1. Click API keys
Revoke the key · Click API keys
  1. Click Revoke
Revoke the key · Click Revoke
  1. Click Revoke
Revoke the key · Click Revoke
  1. Click the endpoint
Revoke the key · Click the endpoint
  1. In Key or token, type ••••••••
Revoke the key · In Key or token, type ••••••••
  1. Click ▶ Send
Revoke the key · Click ▶ Send
Revoke the key · 401: the key was revoked.

This guide was carried out step by step on 22 Oct 2026 by an automated test on Flow (version 3e563176).