API Keys
Keys authenticate server-side clients and MCP tool calls.
Create a key
Open Dashboard → API Keys (also linked as www.oflo.ai/api-keys).
New keys use the format sk_<prefix>_<secret>. The full secret is shown once — store it in an environment variable such as OFLO_API_KEY.
Request headers
| Header | Example |
|---|---|
| Authorization (preferred) | Authorization: Bearer sk_… |
| x-api-key (fallback) | x-api-key: sk_… |
bash
curl "https://www.oflo.ai/api/v1/agents" \
-H "Authorization: Bearer sk_your_api_key_here"Default permissions
Newly generated keys typically include CRM and agent scopes such as:
read/write:leads,read/write:deals,read/write:accounts,read/write:brands,read/write:customers,read/write:investorsread/write:contacts,read/write:lists,read/write:pipelines,read/write:campaigns,read/write:programs,read/write:tasks,read/write:notes,read/write:segmentsread/write:sequences,read/write:single_sends,read/write:job_postings- HR:
read/write:employees,departments,positions,attendance,payroll,offers,applications,interviews read:credits,read:agents
Wildcards like *, write:*, or admin:* may also grant broader access. If an SDK method returns a permission error on an older key, regenerate a key from the dashboard.
Expiration
Default lifetime is 30 days. When creating a key you can choose presets such as 30, 90, 365 days, or never.