The machine API is authenticated with a workspace-scoped API key. Create one from Settings → API Keys — keys are shown once at creation time and only a masked prefix is stored after that, so save it somewhere safe.

Send it as a bearer token or a dedicated header — either works:

Authorization: Bearer fl_live_YOUR_API_KEY
# or
X-Api-Key: fl_live_YOUR_API_KEY

A key is bound to exactly one workspace and to a set of scopes chosen when it was created — template:read, template:write, render:write, asset:read, asset:write. A request that needs a scope the key wasn't granted is rejected — there is no implicit escalation. See API keys & scopes for the full scope catalog.

A missing or malformed key fails with 403 INVALID_API_KEY, not 401 — a deliberate choice so scanning for valid key prefixes can't be distinguished from any other rejection. A key on a suspended subscription fails with 403 SUBSCRIPTION_SUSPENDED.

Embed sessions

Routes under /v1/embed/* that act on a specific end-user use a different credential: a short-lived embed session bearer token, minted by POST /v1/embed/:embedId/session — not an fl_live_… key. See Embed.