X-API-Key header alongside the customer header containing your workspace identifier.
Create a key
Requires you to act: Sign in to Flow and open Settings → API & MCP. Create the key under your own account:- Select Generate Key under Your API Keys.
- Enter a name that identifies the integration, such as
requirements-sync. - Select Generate, then copy the key into your secret manager. Flow displays the raw key once.
Workspace identifier
Find the MCP URL in Settings → API & MCP. Its final path segment is your workspace identifier: forhttps://backend.branch.flowengineering.com/mcp/your-workspace, send your-workspace in the customer header. Use the identifier, not a full URL or display name.
The header identifies your workspace; your API key grants access according to your account’s permissions.
Authenticate requests
Set the variables in the quickstart before running these examples. Python usesrequests; JavaScript uses Node.js 22 or later with .mjs files.
brd_ prefix, in X-API-Key. Do not prepend Bearer to an API key. Send both headers on every request.
The reference also shows bearer authentication for Flow access tokens. A personal API key is the supported starting point for the integrations in these guides.
Understand permissions
A key uses its creator’s identity and current access. It does not add permissions or bypass project access, read-only roles, or branch restrictions. Keys are long-lived. Store them as secrets, use a separate key per integration, and revoke keys that are no longer needed. External share recipients cannot create personal API keys.Rotate or revoke a key
Create a replacement key, update the integration’s secret, and verify a read request with the new key. Then revoke the old key in Your API Keys. A workspace administrator can also revoke keys owned by other users. Revocation prevents subsequent requests using that key. A key only grants access to resources its creator can use.Troubleshoot authentication
Keep keys out of source control, URLs, screenshots, and error reports. The playground sends requests directly from your browser to
https://backend.branch.flowengineering.com.