Flow.Documentation
Professional

Publish an API with keys

7 steps± 5 minVideoVerified 22 Oct 2026
  1. Step 1 · Open your development environment
  2. Step 2 · Create an API
  3. Step 3 · Add an endpoint
  4. Step 4 · Decide the answer
  5. Step 5 · Issue a key
  6. Step 6 · Store the key
  7. Step 7 · Call the endpoint

You create an API with one endpoint that runs a workflow, and give a consumer a key that opens only this API and has only the permission the endpoint asks for. Then you call the endpoint the way the consumer does. Every call can be traced to a consumer, with a key that expires.

Watch the whole guide as a video7 steps in one film
Step 1 / 7

Open your development environment

In the portal, under Environments, click Development, and there Open. Flow opens in a new tab and you are signed in straight away.

  1. Click Development
Open your development environment · Click Development
  1. Click Open ↗
Open your development environment · Click Open ↗
Step 2 / 7

Create an API

Click ＋ next to General and choose New API. An API is a base path with one security policy; every endpoint lives under it and inherits that policy. By default it asks for an API key.

  1. Click Add to General
Create an API · Click Add to General
  1. Click New API
Create an API · Click New API
  1. In Name, type Stock
  2. In Base path, type /stock
Create an API · In Name, type Stock; In Base path, type /stock
  1. Click Save API
Create an API · Click Save API
Step 3 / 7

Add an endpoint

An endpoint binds one method and path to one workflow. Ask for an extra permission (scope) here: only keys with that permission get through. With ＋ New workflow, Flow creates the workflow behind it right away and opens it.

  1. Click ＋ Endpoint
Add an endpoint · Click ＋ Endpoint
  1. In Name, type Get stock
  2. In Method, choose GET
  3. In Path, type /status
  4. In Additional required scopes, type stock:read
Add an endpoint · In Name, type Get stock; In Method, choose GET; In Path, type /status; In Additional required scopes, type stock:read
  1. Click ＋ New workflow
Add an endpoint · Click ＋ New workflow
Step 4 / 7

Decide the answer

The new workflow runs from the trigger to API response. Click API response and put in the body what the consumer gets back. Here it is fixed; in real life it comes from a table or another system.

  1. Click the step ‘API response’
Decide the answer · Click the step ‘API response’
  1. Click Code
Decide the answer · Click Code
  1. In Body, type `{
Decide the answer · In Body, type `{; ; ;
  1. Click Save
Decide the answer · Click Save
Step 5 / 7

Issue a key

Under Security → API keys you give a consumer a key. It belongs to a department, opens only the API you tick, has only the permissions you name and expires by itself.

  1. Click Security
Issue a key · Click Security
  1. Click API keys
Issue a key · Click API keys
  1. Click ＋ New key
Issue a key · Click ＋ New key
  1. In Name, type Web shop → stock
Issue a key · In Name, type Web shop → stock
  1. Click Stock
Issue a key · Click Stock
  1. In Permissions (scopes), type stock:read
Issue a key · In Permissions (scopes), type stock:read
  1. Click Issue key
Issue a key · Click Issue key
Step 6 / 7

Store the key

You see the key only once: Flow keeps only a fingerprint. Copy it into the consumer's password vault (covered up in this guide).

Store the key · The new key, visible once.
  1. Click Done, I stored it
Store the key · Click Done, I stored it
Store the key · The key, with what it opens and until when.
Step 7 / 7

Call the endpoint

Open the endpoint. On the right is Try it: it calls the API exactly as a consumer would, with the key in the X-API-Key header. You see the status code, the time and the answer.

  1. Click the endpoint
Call the endpoint · Click the endpoint
  1. In Key or token, type ••••••••
Call the endpoint · In Key or token, type ••••••••
  1. Click ▶ Send
Call the endpoint · Click ▶ Send
Call the endpoint · 200: the key fits and the permission matches.
Call the endpoint · Your workflow's answer.

This guide was carried out step by step on 22 Oct 2026 by an automated test on Flow (version 3e563176).