---
title: Authentication
description: Create API keys, configure scopes, and authenticate requests to the Wireflow API.
updated: 2026-10-03
---

The Wireflow API uses API keys for authentication. Every request must include a valid key in the `Authorization` header.

## Creating API Keys

1. Go to **Settings > API Keys** in the [Wireflow dashboard](https://www.wireflow.ai)
2. Click **Create API Key**
3. Give it a name and select the scopes you need. A new key starts read-only (`workflows:read` and `executions:read`); pick **Full access** or tick more scopes if your integration needs to edit or run workflows
4. Copy the key — it starts with `sk-` and is only shown once

## Making Authenticated Requests

Include your API key as a Bearer token:

```bash
curl https://www.wireflow.ai/api/v1/workflows \
  -H "Authorization: Bearer sk-your-api-key"
```

If the key is missing or invalid, the API returns `401 Unauthorized`:

```json
{
  "error": "Invalid API key format. Expected: Bearer sk-..."
}
```

## Scopes

When creating an API key, assign only the scopes your integration needs:

| Scope               | Description                                                                                |
| ------------------- | ------------------------------------------------------------------------------------------ |
| `workflows:read`    | List and retrieve workflows                                                                |
| `workflows:write`   | Create, update, and delete workflows                                                       |
| `workflows:execute` | Execute workflows                                                                          |
| `executions:read`   | View execution status and history                                                          |
| `usage:read`        | View credit balance and usage                                                              |
| `apps:execute`      | Execute [published apps](/docs/api/apps)                                                   |
| `social:read`       | List your [connected social accounts](/docs/api/social) and read how their posts performed |

## Verify which account a key acts as

API keys and the MCP connector resolve identities independently. If you run more than one key or agent, confirm the identity before writing:

```bash
curl https://www.wireflow.ai/api/v1/me \
  -H "Authorization: Bearer sk-your-api-key"
```

```json
{
  "data": {
    "userId": 42,
    "email": "you@example.com",
    "name": "You",
    "plan": "PRO",
    "credits": 1200,
    "authMethod": "api_key"
  }
}
```

Works with any valid key, no extra scope needed. The MCP server exposes the same check as the `whoami` tool.

## Key Expiration

API keys can have an optional expiration date. Expired keys return `401` with the message `"API key has expired"`. You can set expiration when creating the key, or leave it blank for a non-expiring key.

## Best Practices

- **Never commit API keys to version control.** Use environment variables or a secrets manager.
- **Use the minimum scopes required.** A key that only needs to execute workflows should not have `workflows:write`.
- **Rotate keys regularly.** Create a new key, update your integration, then delete the old one.
- **Set expiration dates** on keys used for temporary integrations or CI/CD.
- **Use separate keys** for different environments (development, staging, production).

## Environment Variable Example

```bash
# .env (never commit this file)
WIREFLOW_API_KEY=sk-your-api-key
```

```javascript
const response = await fetch('https://www.wireflow.ai/api/v1/workflows', {
  headers: {
    Authorization: `Bearer ${process.env.WIREFLOW_API_KEY}`,
  },
});
```

---

Documentation index: fetch https://www.wireflow.ai/llms.txt for the full list of Wireflow docs.