API Keys

Some integrations and services authenticate with API keys instead of OAuth. How you store them depends on the use case.

App integration keys (recommended)

For apps in the TogoFlow catalog that use API key, bearer token, basic, or custom auth, store credentials once and reuse them:

1. Go to Settings → Connections and click Add credential, or
2. Open an Action / Start / End node, select the app, and click Connect.

Enter the key or token in the modal. Secrets are saved for the organization and used automatically at run time — not pasted into every node.

See Connections & Credentials and Connecting Apps.

Examples of key-based apps:

Organization API keys

Manage keys in Settings → API Keys (under Credentials). These are TogoFlow keys (wk_...) for authenticating calls to your workflows — not third-party app secrets.

1. Click Create API Key.
2. Give it a name and optional description.
3. Copy the key immediately — it's only shown once.
4. Use it for webhook authentication, public API access, or MCP clients.

Organization API keys have scopes and optional expiration dates. Revoke keys you no longer need.

New keys include scopes for MCP access (mcp:use, workflows:read, workflows:execute, executions:read). Use them to connect Claude Code, Cursor, or other MCP clients to run workflows from AI chat. See MCP Server for setup.

AI provider keys

AI nodes need a key from your chosen provider:

Add your key in Settings → Agent (organization default) or directly in the AI node's configuration panel.

Workflow variables for secrets

For one-off values or APIs without a catalog integration, store secrets as workflow variables instead of hardcoding them in node fields:

Reference with {{variables.weatherApiKey}} in HTTP URLs, headers, or Function node code.

Prefer Settings → Connections when a dedicated app integration exists.

HTTP Request authentication

For APIs without a dedicated integration, use the HTTP Request node:

Headers:
  Authorization: Bearer {{variables.apiToken}}
  X-API-Key: {{variables.serviceKey}}

Or append to the URL:

https://api.example.com/data?api_key={{variables.apiKey}}

Security best practices

• Never commit API keys to version control or share them in workflow exports.
• Use Settings → Connections for catalog apps; use workflow variables for ad-hoc HTTP secrets.
• Rotate keys periodically and revoke unused ones.
• Use test/sandbox keys during development (e.g. Stripe sk_test_...).
• Set expiration dates on organization API keys when possible.

Troubleshooting