Configure API access
On this page
Gateway credentials identify an integration, while IdP tokens identify app users. Configure the layers your action requires and test them together from the client that will make real requests.
Choose the access model#
| Mechanism | Purpose |
|---|---|
| API key access | Identify and scope a programmatic integration |
| Signed requests | Prove possession of the API secret without sending it as a plain request field |
| Basic authentication | Authenticate a client using the action's configured Basic-auth contract |
| IdP Authorize node | Authenticate and authorize an application user within the workflow |
| CORS Origin | Control browser origins for gateway requests |
| Origin Validator | Apply country and IP rules |
A bearer token does not automatically satisfy a gateway API-key requirement. Gateway checks happen before the workflow's IdP Authorize node.
Create and scope a key#
Open Workflows → API Key Access. Configure the intended environment and choose the appropriate access scope. Keys can be blocked, restricted to selected actions, or granted broader access.
Use separate credentials for distinct integrations so access and usage can be reviewed independently. If request limits are enabled, inspect their daily, weekly, and monthly settings and the affected environment.
The action's generated request examples or Postman collection are useful for matching the enabled authentication mode. Do not combine several authentication methods by guesswork when troubleshooting a rejected request.
Browser applications#
Use an endpoint designed for browser access, with appropriate user authorization for private data. A browser's identity token and its allowed origin serve different purposes. Configure both when required.
Verify the boundary#
Test a valid caller, a missing credential, an invalid credential, and a caller outside the allowed action scope. For a user-authorized workflow, also test a signed-in user without the required role or permission.
Check the gateway response and action logs before changing the graph. For signatures see request signing; for browser failures see CORS.
Need to investigate a problem? Start with troubleshooting