Skip to main content

API keys

API keys give scripts and integrations long-lived, programmatic access to the REST API without a browser session.

Issuing a key​

Create a key two ways:

  • In the app, from Settings → API Keys.
  • Over the API, with POST /api/v1/keys and a name:
curl -X POST https://<your-host>/api/v1/keys \
  -H "Authorization: Bearer <session-token>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "ci-export-bot" }'

The response contains the full key, which begins with ef_live_.

warning

The key value (ef_live_...) is shown once. EntityFlow stores only a hash of it — it can never be retrieved again. Copy it immediately and keep it somewhere safe.

Using a key​

Send it as a bearer token on any REST request:

curl https://<your-host>/api/v1/diagrams \
  -H "Authorization: Bearer ef_live_xxxxxxxxxxxxxxxx"

Listing and revoking​

You can list and revoke keys at any time, from Settings → API Keys or over the /api/v1/keys endpoints. Revoking a key takes effect immediately.

Permissions​

Issuing and revoking keys requires the account:manage permission. A key inherits the tenant-scoped permissions of the account that owns it.