API tokens

An API token lets a script or another system work with Flowtly on your behalf, without anyone signing in on the sign-in screen. You create and revoke your own tokens under Profile → Security, in the API tokens section.

A token acts as you

Read this before you give a token to anyone or anything.

A token carries your identity and your permissions. Whatever you can see and change in Flowtly, anything holding your token can see and change too, and everything done with it is done as you.

• It is not an organization key. It belongs to the person who created it, and it reaches what that person can reach.
• It cannot be limited. There is no read-only token and no token for just one module: every token has all of your access.

So handing a token to an integration is handing it your own access. Give one only to a system you would trust with your account, and create it as the person whose access the integration actually needs.

Connecting an AI assistant such as Claude or ChatGPT needs no token at all: see Connecting AI tools.

Creating a token

1. Open Profile → Security and go to API tokens.
2. Type a Token name that says where the token will be used, such as the name of the integration. It can be up to 32 characters. Without one, the token is called "API token".
3. Choose Generate token.

Flowtly then shows the token, once. Choose the copy icon and store it somewhere safe, such as a password manager or the integration's own secret storage, before you choose Done. Flowtly does not keep a copy it could show you again: once that window is closed, the token cannot be retrieved by you or by anyone else. If it is lost, revoke it and create a new one.

How long a token lasts

A token created here is valid for 365 days from the moment you create it. That is the default lifetime, and 730 days is the longest Flowtly issues a token for, so no token stays valid indefinitely. A token cannot be extended: before it expires, create a new one, give it to the integration, then revoke the old one.

The API tokens list shows each of your tokens by name, with the date it expires (or expired) and when it was last used. An expired token stays in the list until you revoke it. A token that has not been used for months is a good one to revoke.

Revoking a token

Choose the bin icon next to a token to revoke it. There is no confirmation step.

Revoking takes effect at once: the very next request made with that token is refused, rather than the token running on until its expiry date. A revoked token cannot be restored; if it is still needed, create a new one.

Some things stop your tokens without you revoking them:

• A password reset. Completing a password reset stops every token you created before it, along with your other sessions. They stay in the list as if they were still valid, so revoke them too, and create new tokens for your integrations.
• A deactivated account. If your Flowtly account is deactivated, every token you created stops working for as long as the account stays deactivated. Revoke them if they must not come back.

Nobody else can list or revoke them from their own Profile → Security.

Example use cases

• A team lead connects a time-logging script to Flowtly with a token named after the script, stored in the script's secret settings.
• A consultant who pasted a token into the wrong place revokes it at once, knowing it stops working on its next use.
• An administrator sets a reminder eleven months after creating an integration's token, and replaces it before the 365 days run out.
• Before giving a token to an outside tool, a manager checks what their own account can reach, because the tool will reach exactly the same.