API tokens
Create a personal API token for scripts and continuous integration, keep it safe, and revoke it when you no longer need it.
An API token lets a script, a local tool or a continuous integration job read your workspace through GetFlowing's API, as you, with read-only access.
Create a token
- Go to Settings, then Developer, and find API tokens.
- Choose Create token, give it a name that says where it is used, such as
CI / GitHub Actions, and choose Create token. - Copy the token. This is the only time GetFlowing shows it.
Send it in the Authorization header of each request, as Bearer followed by the token.
What a token can do
A token can read, but it cannot change anything: deploying, approving, changing settings and anything else that changes your workspace needs a person signed in to GetFlowing. A token cannot manage your own account either.
The API's reference and address are not published yet. Until they are, ask on the Help page if you need to use a token. See Get help.
Keep tokens safe
- Treat a token like a password. Store it as a secret in your CI system, never in a repository.
- Create one token for each place you use it, so you can revoke one without breaking the others.
- Each token shows when it was created and last used. Choose Revoke on any you do not recognise or no longer need.
- When someone leaves your team, their tokens are revoked with them.
Webhooks
Send GetFlowing's deploy, incident and approval events to your own systems as signed HTTPS requests, and check each request really came from GetFlowing.
Plans, credits and limits
What each GetFlowing plan includes, and how agent work units, AI credits, build minutes, deployments and add-ons are counted.