metadata.developersAuthentication.title

Bearer token

The key goes in the Authorization header — on both surfaces, with no further headers. Calls without a valid key answer 401.

Authorization: Bearer $FUTUREWAY_API_KEY

Create and revoke keys under Settings → API & CLI. The plaintext is shown exactly once.

Two key kinds

A personal key acts as you. A service key is your organisation's machine identity and sees only what was explicitly shared with it.

	Personal key	Service key
Prefix	`sk-fw-api-…`	`sk-fw-svc-…`
Acts as	the person it belongs to — the same rights as in the browser	the organisation, no person
Sees	everything you see yourself	only resources an admin shared with the key
Scopes	fixed: inference, agents:run, knowledge:read	chosen at creation from the list below
Who creates it	every member with a platform seat	owners and admins
Lifetime	ends with the account; revoked on offboarding	survives staff changes; ends only by revocation or expiry

Scopes

A scope opens access to a family of endpoints. What is visible inside it is still decided by the platform's permissions — a scope is never a right to a particular resource.

Scope	Opens	Personal	Service
inference	Inference API: chat completions, embeddings, model list.	yes	yes
agents:run	Run agents (App API, coming).	yes	yes
knowledge:read	List knowledge areas, read files, search and graph queries (App API, coming).	yes	yes
knowledge:write	Upload, replace and delete files in knowledge areas (coming).	no	yes
agents:manage	Create and change agents (coming).	no	yes
prompts	Create, change and delete prompts (coming).	no	yes
usage:export	Export aggregated usage — never chat content (coming).	no	yes
audit:read	Read the organisation's audit log and usage protocol (coming).	no	yes
members:invite	Invite and deactivate members (coming).	no	yes

Scopes are fixed at creation and can only be narrowed. More rights mean a new key. If a key lacks an endpoint's scope, the App API answers 403 scope_missing.

A service key appears in the share dialog of every shareable resource (agents, knowledge areas, prompts) as its own recipient — next to groups and members, visible to owners and admins only. Only with a share may the key see or use the resource through the API; revoking the key deletes its shares.

Expiry, rotation, revocation

Expiry at creation: 30 · 90 · 365 days — or no expiry
Expired key: 401 key_expired
Rotation: mints a new secret for the same key entry; scopes and expiry stay, the old plaintext is invalid immediately.
Revoked key: 401 unauthorized

Security rules

Server-to-server only: the API is not meant for calls from web pages or apps on end-user devices.
Keys live in environment variables or a secret store — never in source code, never in logs.
Requests with an Origin header, fetch metadata or a session cookie are rejected with 403.
One key per application and environment, with the fewest scopes it needs.

This is what the rejection of a browser request looks like:

{
  "error": {
    "code": "browser_request_rejected",
    "message": "The App-API accepts server-to-server requests with an API key only.",
    "request_id": "3f6c1c9e-0a4b-4c3e-9b0e-6a1d2f8e4b21"
  }
}