API Keys

Some integrations and services authenticate with API keys instead of OAuth. How you store them depends on the use case.

App integration keys (recommended)

For apps in the TogoFlow catalog that use API key, bearer token, basic, or custom auth, store credentials once and reuse them:

1. Go to Settings → Connections and click Add credential, or
2. Open an Action / Start / End node, select the app, and click Connect.

Enter the key or token in the modal. Secrets are saved for the organization and used automatically at run time — not pasted into every node.

See Connections & Credentials and Connecting Apps.

Examples of key-based apps:

Organization API keys

Manage keys in Settings → API Keys (under Credentials). These are TogoFlow organization keys for authenticating calls to your workflows — not third-party app secrets.

1. Click Create API Key.
2. Give it a name and optional description.
3. Copy the key immediately — it's only shown once.
4. Use it from a server or trusted backend for chat triggers (API mode), public API access, or MCP clients.

Organization API keys have scopes and optional expiration dates. Revoke keys you no longer need.

New keys include scopes for MCP access (mcp:use, workflows:read, workflows:execute, executions:read). Use them to connect Claude Code, Cursor, or other MCP clients to run workflows from AI chat. See MCP Server for setup.

Keep keys off the frontend

• Do not embed organization API keys in browser JavaScript, public websites, or mobile apps.
• For a support bubble on your site, use the Chat Start node’s Website widget and a publishable embed token (tce_…) — not an organization API key. See Chat trigger → Website widget.
• If you build a custom chat UI, call your own backend (or an authenticated app proxy). Your backend holds the organization API key and forwards the message to TogoFlow.
• Webhook Start-node secrets (API key / bearer / basic) are separate from organization API keys — you create them on the Start node, then register that same secret with the external app (header or ?api_key= query).

AI provider keys

AI nodes use your own provider key when connected (BYOK). Add it under Settings → Connections:

1. Go to Settings → Connections and click Add credential.
2. Choose OpenAI, Anthropic, Gemini, or Groq.
3. Paste your API key and save.

That key is used for AI nodes run by you in this organization. If you have not connected a provider, the platform may fall back to a shared default key when available. See Connections & Credentials.

Workflow variables for secrets

For one-off values or APIs without a catalog integration, store secrets as workflow variables instead of hardcoding them in node fields:

Reference with {{variables.weatherApiKey}} in HTTP URLs, headers, or Function node code.

Prefer Settings → Connections when a dedicated app integration exists.

HTTP Request authentication

For APIs without a dedicated integration, use the HTTP Request node:

Headers:
  Authorization: Bearer {{variables.apiToken}}
  X-API-Key: {{variables.serviceKey}}

Or append to the URL:

https://api.example.com/data?api_key={{variables.apiKey}}

Security best practices

• Never commit API keys to version control or share them in workflow exports.
• Never ship organization API keys to the browser — use the chat embed token for the website widget, or proxy automation calls through your server.
• Use Settings → Connections for catalog apps; use workflow variables for ad-hoc HTTP secrets.
• Rotate keys periodically and revoke unused ones.
• Use test/sandbox keys during development (e.g. Stripe sk_test_...).
• Set expiration dates on organization API keys when possible.
• Require authentication on webhook triggers before publishing.

Troubleshooting