Share access with an AI agent

Agents should never hold a copy of your API key. Instead you mint a pre-approved, single-use link. The agent redeems it once and receives its own credential — scoped, expiring, and revocable on its own without rotating anything of yours.

How it works

  1. You mint a handoff link (below, or POST /v1/oauth/handoff).
  2. You hand it over — paste it into the agent's chat, or drop it in its config.
  3. The agent redeems it at POST /v1/oauth/handoff/exchange and gets its own access_token. The link is burned; replaying it fails.
What the agent can and cannot do. The token carries a fixed scope set and an expiry. It cannot mint further credentials, cannot widen its own scopes, and cannot read anything outside the organization you shared. Revoking it does not touch your API key.

Try it now — no account, no signup

This mints against a throwaway sandbox organization, so you can watch the whole exchange without exposing anything real. It is the same flow, same endpoints.

Doing it from code

# 1. You mint (authenticated as yourself)
curl -X POST https://back.flowie.ink/exchange/v1/oauth/handoff \
  -H "Authorization: Bearer $YOUR_KEY" -H 'Content-Type: application/json' -d '{}'

# -> { "handoff_token": "...", "handoff_url": "...",
#      "expires_at": "...", "scopes": [...], "organization_id": "..." }

# 2. The agent redeems (no auth — the token IS the authorization)
curl -X POST https://back.flowie.ink/exchange/v1/oauth/handoff/exchange \
  -H 'Content-Type: application/json' -d '{"handoff_token":"..."}'

# -> { "access_token": "...", "scopes": [...], "expires_in": ...,
#      "organization_id": "...", "company_id": "..." }

# 3. The agent works with its own token
curl https://back.flowie.ink/exchange/v1/documents?limit=1 \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Which flow should I use?

SituationUse
An agent evaluating the API on its own POST /v1/sandbox/bootstrap — no human at all
You handing an agent access to your data This page — handoff link
A product signing users in and acting for them /v1/oauth/authorize — OAuth 2.0 + PKCE consent

Full detail, written for agents to read directly: auth.md · API reference · Build with AI