{"schemaVersion":"1","contentVersion":"2026-10-18.1","slug":"api-keys","title":"Call workflows with API keys","summary":"Give a backend or external integration permission to call a workflow without exposing credentials in your frontend.","category":"Developer reference","minutes":8,"prerequisites":["Permission to manage API keys and the target workflow’s group access.","A saved workflow and its actual endpoint and input contract.","A server-side caller or integration that can store credentials securely."],"sections":[{"id":"choose","title":"Choose the correct credential","blocks":[{"type":"table","headers":["Credential","Purpose"],"rows":[["Rumata API key","Authenticate an integration to Rumata resources, subject to the key’s group permissions and validity."],["Third-party secret","Authenticate an outgoing call to a provider such as Slack or Stripe. It does not grant permission to invoke a Rumata workflow."],["Application-user authentication","Identify the person using your app. A shared integration key is not a replacement for per-user authorization."]]},{"type":"paragraph","text":"A private workflow needs an authorized caller. Creating an API key does not automatically grant access to every workflow or make a workflow public."}]},{"id":"create","title":"Create and authorize an API key","blocks":[{"type":"steps","items":["Open **System Explorer → Access → Keys & secrets → API keys** and select **Create API key**.","Choose a descriptive name and an expiration appropriate to the integration. Review the settings before selecting **Create and save credential**.","Use the saved credential through its supported secret reference or credential configuration. Do not paste it into an AI conversation or commit it to source control.","Review the key’s **Groups** and the target workflow’s **Manage access** settings. Grant the integration’s group the permission needed to invoke that workflow.","Confirm that the workflow and key belong to the intended project and factory, and that the key is active."]},{"type":"paragraph","text":"New keys join the factory API-key group with storage access. Workflow or service access must be granted through the relevant group; storage access alone does not authorize workflow execution."}]},{"id":"call","title":"Call the intended workflow","blocks":[{"type":"steps","items":["Open the workflow’s **More actions → API & schemas** and copy the actual endpoint. Read its method, input schema, and published version.","Configure the server-side caller with that endpoint and the API-key authentication required by the endpoint’s current API instructions. Use the documented header and format; do not place the key in a URL or infer a header from an unrelated provider.","Send harmless input that matches the workflow schema. Test against a destination that will not send real notifications or modify important records.","Inspect both the HTTP response and the corresponding workflow run. For asynchronous execution, follow the run status until it completes or fails.","Verify that a request without the credential or without the required group access is rejected when the workflow should be private."]},{"type":"note","title":"Keep the key on the server","text":"A key included in browser JavaScript or a browser-exposed variable can be copied by visitors. Route privileged operations through a backend that checks the application user’s permissions before invoking the workflow."}]},{"id":"maintain","title":"Troubleshoot and rotate credentials","blocks":[{"type":"table","headers":["Symptom","Check"],"rows":[["Authentication or permission failure","The credential format, Active status, expiration, project/factory, key groups, and workflow access."],["Route or method failure","The exact published endpoint and method from API & schemas."],["Input validation failure","The request content type and body against the workflow schema."],["Request accepted but no expected result","The run’s final status, step errors, and downstream integration credentials."]]},{"type":"paragraph","text":"Expiry is checked on every request. Expired and revoked keys remain listed for reference but cannot authorize new requests. To rotate a key, configure and test its replacement in every dependent caller before revoking the old key. Avoid blindly retrying a request that may already have caused a side effect."}]}],"technical":[],"related":["system-explorer-secrets","triggers","controls-workflows","collaboration","backends"],"sources":["Live Rumata API keys view inspected October 18, 2026; no keys created or permissions changed.","Existing HTTP trigger and Keys & secrets documentation."],"updated":"2026-10-18","audience":"general","media":[],"video":null,"url":"https://docs.rumata.dev/guides/api-keys"}