Glossary · Security & access
Scoped API key
Also called: restricted API key, least-privilege key, API token with scopes
A scoped API key is an API credential limited to specific permissions (scopes), often with an expiry date, so that a leaked or misused key can only do what it was explicitly allowed to do.
An all-access key is a skeleton key: whoever holds it can do anything the account can. A scoped key is a key cut for one door. If the reporting script's key leaks, an attacker can read run results, not delete workflows or change billing.
Practices worth adopting
- One key per system. The CRM sync, the reporting dashboard and the CI pipeline each get their own. Revoking one breaks nothing else, and logs show which system did what.
- Smallest scope that works. Start narrow and add scopes when something fails with a clear permission error.
- Expiry dates for anything temporary: a contractor's script, a migration, a demo.
- Show once, store hashed. A good API shows the full key once at creation and keeps only a hash, so even the vendor can't read it back.
- Audit usage. Keys that haven't been used in months are candidates for deletion.
Scoping limits the blast radius; it doesn't replace keeping the key secret. Treat every key as a password.
In Fluxo Flow
Fluxo Flow's REST API uses scoped API keys: give each system its own key with only the scopes it needs, an optional expiry and instant revocation. Keys are stored hashed and shown once. The API is included on every paid plan, with per-plan rate limits and an OpenAPI 3.1 file in the docs.
Read next
Related terms
- API key vs OAuthAn API key is a static secret that identifies the caller and grants whatever access it was created with, while OAuth issues short-lived, scoped tokens after a user approves access; OAuth is safer for user-facing connections, keys are simpler for server-to-server use.
- RBAC (role-based access control)Role-based access control (RBAC) is a way of managing permissions in which access rights are attached to roles (such as Admin, Editor or Viewer) and people get rights by being assigned a role, rather than permission by permission.
- Audit logAn audit log is a chronological, tamper-resistant record of who did what in a system and when, kept so that changes, approvals and access can be traced afterwards.
- SSO and SAMLSingle sign-on (SSO) lets people use one company identity to sign in to many applications, and SAML (Security Assertion Markup Language) is a widely used standard that carries that sign-in from the identity provider to each app.
- RPA (robotic process automation)Robotic process automation (RPA) uses software bots that operate applications through their user interface (clicking, typing and reading screens) the way a person would, typically to automate systems that have no usable API.