---
title: "API Keys"
description: "Create, list and revoke Flowie Exchange API keys from your browser. Sign in with your Flowie account — no curl required."
canonical: "https://docs.get-flowie.com/sandbox/keys"
source: "https://docs.get-flowie.com/sandbox/keys.html"
---

# API Keys

API Keys

# Manage your API keys

Create a long-lived API key for your Flowie organization, list the keys that already exist, and revoke any you no longer need — all from this page. Sign in with the same Flowie account you use for the dashboard; the key inherits your organization and tier. Keys minted here are also remembered locally so the [Playground](<../playground/index.html>) and [API reference](<../reference/index.html>) Try-it widgets can pick them from a dropdown.

Where the key works

A key belongs to the **environment it was created on** — `https://back.flowie.ink/exchange` (staging) or `https://back.p2p-flowie.com/exchange` (production). These are **separate backends with separate keys** : a staging key returns `401` on production and vice-versa. Pick the environment in the form below before creating. Pass the key as `Authorization: Bearer flw_…`. Note the prefix is the _mode_ , not the environment: `flw_live_…` = live mode, `flw_test_…` = sandbox mode — both exist on staging _and_ production, so the prefix alone does **not** tell you which environment a key is for. The full string is shown **once** , right after creation — save it in your secret store before navigating away (we also cache it in this browser's `localStorage` so the Playground can reuse it). 

### Sign in to manage your API keys

If you're already signed in to Flowie in another tab, we'll detect it automatically. Otherwise, open the dashboard, sign in, then come back here.

[Sign in with Flowie ↗](<#>) I just signed in — recheck

Or paste a Flowie JWT manually

Paste an `access_token` from your Flowie session (DevTools → Application → Local Storage → look for an `@@auth0spajs@@::…` entry on `staging.flowieapp.io`, or grab a `Bearer …` header from a Network request). Stored only in this browser's `localStorage`.

Save token

No account? [Sign up for free](<https://staging.flowieapp.io/signup?utm_source=docs_keys>) — under a minute, then come back here.

## Create a new key

Name  Environment  Staging · back.flowie.ink Production · back.p2p-flowie.com Company (optional)  (org-wide — no specific company)

Create key

**✓ Key created.** Copy it now — you will not see the full value again.

Copy

## Your keys

Name | Env | Prefix | Company | Created | Expires |   
---|---|---|---|---|---|---  
  
No API keys yet. Create one above to get started.

## How it works

This page calls the same public endpoints documented in the [API reference](<../reference/index.html#create-api-key>). Nothing happens server-side that you couldn't reproduce with `curl`:

  * **Create** → `POST /v1/api-keys` with `{"name": "...", "companyId": "..."}`.
  * **List** → `GET /v1/api-keys` (paginated; this page reads the first 100).
  * **Revoke** → `DELETE /v1/api-keys/{id}` (204 on success). Revocation is immediate; any in-flight request finishes, but the next one returns `401`.



Your Flowie JWT is held in `localStorage` only (key `flowie-playground-state.key`). It never leaves the browser except as an `Authorization: Bearer …` header to the Exchange API. If you belong to multiple organizations, use the organization picker in the topbar to choose which one a new key targets — the picker sets the `X-Flowie-Organization-Id` header on every request.

The page detects your existing Flowie session via a hidden iframe (`/__exchange-handshake.html`) hosted on `staging.flowieapp.io` (or `app.flowie.me` in production). The iframe reads the Auth0 SDK's cached access token from the dashboard's `localStorage` and posts it back via `postMessage` — strict origin validation, no servers, no cookies. If you're not signed in there, the page falls back to the dashboard sign-in link or manual JWT paste.