Glossary · Security & access
API key vs OAuth
Also called: API key or OAuth, token vs key
An API key is a static secret that identifies the caller and grants whatever access it was created with, while OAuth issues short-lived, scoped tokens after a user approves access; OAuth is safer for user-facing connections, keys are simpler for server-to-server use.
Both get a request authenticated. They differ in who approves, what's granted and how you take it back.
| API key | OAuth 2.0 | |
|---|---|---|
| Who creates it | You, in the vendor's settings | The vendor, after you approve on its screen |
| Scope | Often everything, sometimes configurable | Specific scopes, shown at consent |
| Lifetime | Until revoked | Short-lived access tokens, renewed by refresh tokens |
| Revoking | Delete the key | Disconnect the app (or revoke the grant) |
| Best for | Server-to-server, internal tools, vendors without OAuth | Connecting a third-party app to a user's account |
Using API keys safely
- Restrict it. Prefer restricted or scoped keys (scoped API key): Stripe's restricted keys, for example, let you grant exactly the permissions an integration needs.
- One key per integration, so revoking one doesn't break the rest.
- Store it encrypted, never in a spreadsheet, a prompt or a log line.
- Rotate it when people with access leave.
Many business systems (field-service, logistics and recruiting platforms among them) only offer API keys or client credentials, so you'll use both kinds. The habits above make keys nearly as safe in practice.
In Fluxo Flow
Connectors use whichever the vendor offers: OAuth for apps like HubSpot, Slack and Google; API keys or client credentials for apps like Stripe (a restricted key with listed permissions), Twilio, Housecall Pro or ServiceTitan. Keys and tokens are tested before saving, encrypted at rest, and never shown again in full. Anything else goes in the credential vault and is referenced by name from HTTP Request steps.
Read next
Related terms
- OAuth 2.0OAuth 2.0 is an authorization standard that lets you grant one application limited, revocable access to your account in another service, without giving it your password, by issuing it access tokens with specific scopes.
- Scoped API keyA scoped API key is an API credential limited to specific permissions (scopes), often with an expiry date, so that a leaked or misused key can only do what it was explicitly allowed to do.
- BYOK (bring your own key)BYOK, or bring your own key, means a software product runs its AI features on an API key from your own AI provider account, so usage is billed to you directly by the provider instead of being resold through the product.
- Approval workflowAn approval workflow is a process that routes a request (an invoice, an expense, a discount, a piece of content) to one or more designated people who must approve or reject it before it can proceed.
- AI guardrailsAI guardrails are automated checks placed before or after a model call that block, correct or route away inputs and outputs that break your rules, such as banned content, leaked data or invalid formats.