API Keys
Create and manage project and Flow credentials for API clients.
API Keys authenticate software calling BotDojo. Open Advanced → API Keys to review each key's name, type, creation date, authorization version, and masked value.
The key remains masked until Show is selected. Copy copies the key. Avoid revealing a key on a shared screen or copying it to an unapproved clipboard history.
Create a key
Select Create API Key, then configure:
| Setting | What it does |
|---|---|
| Name | Identifies the client or deployment that owns the credential. Use one key per client so it can be revoked independently. |
| Type: Project access | Creates a credential for project API access. Its effective authorization still depends on the selected authorization model. |
| Type: Flow runner | Limits the credential to the selected Flow. |
| Authorization: V1 · Legacy owner permissions | Uses the legacy behavior in which calls can inherit the key owner's permissions. Keep it only for compatibility while a client is being migrated. |
| Authorization: V2 · Strict credential permissions | Prevents Flow keys from inheriting the key owner's resource permissions. Prefer V2 for new credentials. |
| Flow | Required for a Flow runner key. Selects the Flow the client may run. |
| Agent Identity | Optionally runs the selected Flow as an active independent Agent identity. Only administrators and owners can change it. |
Operate keys safely
- Store the value in a secret manager, not source code or an environment file committed to a repository.
- Do not reuse a key across unrelated clients.
- Use the narrowest type and the V2 authorization model where supported.
- Select one row and Delete API Key when the client is retired or a key may have been exposed. Deletion can immediately break that client.
The screenshot above intentionally keeps all credential values masked.