Authentication
API keys
Create and manage keys from Settings → API Keys (workspace admins only). Each key has a name, an optional env label (live or test — organizational only, both behave identically), and one or more scopes.
The raw key value is shown exactly once, at creation. After that only a masked prefix (e.g.
fl_live_7c2••••••••••3f9a) is ever stored or displayed — if you lose it, revoke it and create a new one.Revoking a key takes effect on its very next request — there is no propagation delay to plan around.
Authentication
Scopes
Every key must be granted at least one scope at creation. A request that needs a scope the key wasn't granted is rejected with 403 INSUFFICIENT_SCOPE — there is no implicit escalation.
| Param | Type | Notes |
|---|---|---|
| template:read | Read templates, drafts, and derived parameters. | |
| template:write | Create, update, duplicate, and save template drafts. | |
| render:write | Render a template to an image or PDF. | |
| asset:read | List and search workspace assets. | |
| asset:write | Upload workspace assets. |
Insufficient scope
{
"success": false,
"statusCode": 403,
"code": "INSUFFICIENT_SCOPE",
"message": "This credential is missing the render:write scope"
}