Skip to main content
Use a personal API key for scripts and integrations. Send it in the X-API-Key header alongside the customer header containing your workspace identifier.

Create a key

Requires you to act: Sign in to Flow and open Settings → API & MCP. Create the key under your own account:
  1. Select Generate Key under Your API Keys.
  2. Enter a name that identifies the integration, such as requirements-sync.
  3. Select Generate, then copy the key into your secret manager. Flow displays the raw key once.

Workspace identifier

Find the MCP URL in Settings → API & MCP. Its final path segment is your workspace identifier: for https://backend.branch.flowengineering.com/mcp/your-workspace, send your-workspace in the customer header. Use the identifier, not a full URL or display name. The header identifies your workspace; your API key grants access according to your account’s permissions.

Authenticate requests

Set the variables in the quickstart before running these examples. Python uses requests; JavaScript uses Node.js 22 or later with .mjs files.
Send the raw key, including its brd_ prefix, in X-API-Key. Do not prepend Bearer to an API key. Send both headers on every request. The reference also shows bearer authentication for Flow access tokens. A personal API key is the supported starting point for the integrations in these guides.

Understand permissions

A key uses its creator’s identity and current access. It does not add permissions or bypass project access, read-only roles, or branch restrictions. Keys are long-lived. Store them as secrets, use a separate key per integration, and revoke keys that are no longer needed. External share recipients cannot create personal API keys.

Rotate or revoke a key

Create a replacement key, update the integration’s secret, and verify a read request with the new key. Then revoke the old key in Your API Keys. A workspace administrator can also revoke keys owned by other users. Revocation prevents subsequent requests using that key. A key only grants access to resources its creator can use.

Troubleshoot authentication

Keep keys out of source control, URLs, screenshots, and error reports. The playground sends requests directly from your browser to https://backend.branch.flowengineering.com.