# Flowg8 · Authentication

Use a restricted integration key on your server. Every workspace operation also requires X-Organization-Id.

Send Authorization: Bearer $FLOWG8_API_KEY. Administrators create expiring keys under API keys. Secrets are shown once, stored only as SHA-256 hashes and cannot be recovered. Keep them on your server.

Use POST /v1/auth/token to sign in without a browser, or use your normal Flowg8 web sign-in. Both issue FLOWG8_ACCESS_TOKEN. Flowg8 manages authentication; no separate identity-provider setup is required. Interactive actions use this access token, not an ID token. Key management, group linking, AI, billing, inbox and decisions require a signed-in Flowg8 user. Integration keys can never approve requests.

Keys are workspace-bound, expire after 1–365 days and can be revoked for subsequent requests. Keys with serviceAccountId are organization-owned and stay valid when the creator leaves; disabling the service account invalidates all its keys. Legacy keys without serviceAccountId are invalidated when their creator membership is deactivated. Revoke keys explicitly during offboarding.

Workspace access requires an enrolled authenticator. Complete /security in the browser first. Every API request validates the token online and refreshes group membership. Sign-out revokes all current Cognito sessions. API sign-in may return a standard MFA challenge.

## GET /v1/access

Authentication: restricted integration key (scope: any) or Flowg8 sign-in access token
Required tenant header: X-Organization-Id.
Required user permissions: Active workspace membership required. The API checks current membership, roles, key scopes and resource permissions on every request. Documentation visibility grants no access.

## Request example (replace example IDs)

```sh
curl "https://api.flowg8.io/v1/access" \
  -H "authorization: Bearer $FLOWG8_API_KEY" \
  -H "x-organization-id: 10000000-0000-4000-8000-000000000001"
```

Source: /docs/authentication
Full schemas: /docs/openapi.json