Skip to content

API keys & bearer tokens

Not every service uses OAuth. Many accept an API key or a long-lived access token instead. Store it as a credential, and connector and HTTP Request nodes send it for you.

This page covers keys for external services. For keys that let your own code call Flero, see Flero API keys.

Key credentials for a connector

  1. Open Settings → Credentials and click Add Credential, or create one from the node's credential picker.
  2. Pick the service.
  3. Choose the API Key auth type, or OAuth 2.0 and paste an Access Token if you already have one.
  4. Paste the key or token.
  5. Click Test Connection. Flero checks it on the server.
  6. Click Create Credential.

How connectors send the key

Most connectors send the stored key as Authorization: Bearer <key>. An API key credential works for services that expect a bearer token, such as a HubSpot private-app token or a Databricks personal access token.

Some connectors send it differently, and their catalog page says so. For example, Shopify sends it in the X-Shopify-Access-Token header.

Known issue: connectors do not send HTTP Basic authentication. A Basic Auth credential on a connector sends no credentials, so the service rejects the call. This affects Jira, ServiceNow and SAP S/4HANA in particular. Use a token, OAuth where offered, or the HTTP Request node.

Credentials for the HTTP Request node

For a service without a connector, pick Generic / Custom HTTP in the service list and use the HTTP Request node.

Field Notes
API Key / Access Token The secret. Accepts an API key, a bearer token or an OAuth access token.
Second Secret (optional) For APIs that need two secrets, such as an app ID and a key.
Header list Where each value goes. For each header, set the Header name, the Source (Secret 1, Secret 2 or a Literal value) and an optional Prefix, such as Bearer.

The HTTP Request node does not accept authentication typed into the node itself. Pick the credential in the node's credential field.

Rotating a key

  1. Generate a new key in the service's dashboard.
  2. In Flero, Edit the credential, paste the new value and click Update.
  3. Revoke the old key in the service.

Workflows keep working, because nodes reference the credential, not the key.

Bearer tokens

"Bearer token" can mean two things:

  • A short-lived OAuth access token. An OAuth credential manages and refreshes it for you. See OAuth flow.
  • A long-lived personal access token, created in the service. Store it as an API key credential, or paste it as an access token. Flero does not refresh it, so replace it before it expires.

Flero API keys

Flero API keys let your own scripts and pipelines call the Flero API, for example to start a workflow. You create them under Settings → Credentials, in the API Keys card, with Generate API Key. New keys default to Read-only, and the key is shown once.

Send a Flero API key in the x-api-key header, not as a bearer token. Scopes, presets, expiry and revocation are covered in Authentication and API keys.

When you generate a key from Settings, Flero can also save it as a Personal credential, so Flero's own platform nodes can use it.

Tips & gotchas

  • Test after rotating. The most common rotation mistake is pasting the old key. Click Test Connection before relying on it.
  • Keep keys out of node fields and logs. If a Code node builds a header and a Log node prints it, the key ends up in the execution record. Use credentials.
  • Workspace variables are not secret storage. $env is for configuration.

Found something out of date? This page lives in the Flero docs content set.