API Keys

Key Types

FlowSearch uses two types of API keys:

Public / browser

Search Key

fs_pk_...

Use this key in the hosted search scripts. It authorizes search requests without granting account access.

Safe to use in browser code
Works with origin restrictions
Cannot manage website settings

Secret / server only

Admin Key

fs_sk_...

Reserve this key for trusted backend operations. It has broad access and must never reach client-side code.

Never expose publicly
Use only in server-side code
Can manage account settings

Security Warning

Never expose your Admin Key (fs_sk_...) in frontend code, public repositories, or client-side JavaScript. It grants full access to your account.

Getting Your API Keys

Log in to your FlowSearch dashboard
Select your website
Click the "Integration" tab
Your Search Key is displayed and ready to copy
Admin Keys can be viewed/created in the security section

Using Your Search Key

The Search Key is used in the Search Bar Script (all pages). Place this script in the site-wide head/custom-code area.

<script
  src="https://www.flowsearch.io/widget.js"
  data-key="fs_pk_xxxxxxxxxxxxxxxxxxxx"
  data-results-page="/search-results"
  data-live="true">
</script>

Some sites already use the /search slug, so use /search-results or another custom slug and keep data-results-page in sync with the published page.

Origin Restrictions

Protect your Search Key by restricting which domains can use it:

Go to your website settings
Find the "Allowed Origins" section
Add your domain(s):

# Example allowed origins
https://yoursite.com
https://www.yoursite.com
https://preview.example.com

Requests from other domains will be rejected, even with a valid API key.

Rate Limiting

Public Search Key requests use the website's effective plan. The search API also capsper_page by plan. Live-search requests count toward the monthly search quota.

Plan	Search requests/minute	Max per page	Search requests/month
Free	30 req/min	10	1,000
Basic	60 req/min	20	10,000
Pro	120 req/min	50	50,000
Business	180 req/min	50	150,000
Enterprise	600 req/min	100	Custom

Regenerating Keys

If you suspect a key has been compromised:

Go to your website's Integration tab
Click "Regenerate Key"
Update your code with the new key
The old key is immediately invalidated

Downtime Warning

Regenerating a key immediately invalidates the old one. Make sure to update your code before regenerating to avoid search downtime.

Best Practices

For Search Keys

Always set origin restrictions for production
Use different keys for staging and production
Monitor usage in your dashboard

For Admin Keys

Never commit to version control
Use environment variables
Rotate regularly (every 90 days recommended)
Use the principle of least privilege

# Store in environment variables
# .env (never commit this file!)
FLOWSEARCH_ADMIN_KEY=fs_sk_xxxxxxxxxxxxxxxxxxxx

# Access in your code
const adminKey = process.env.FLOWSEARCH_ADMIN_KEY;

Key Permissions

Action	Search Key	Admin Key
Search content	✓	✓
AI search	✓	✓
View analytics	✗	✓
Trigger crawls	✗	✓
Manage settings	✗	✓
Upload documents	✗	✓

API key permissions do not bypass plan entitlements. Follow-up AI conversations and External Knowledge require a paid plan, and chunked uploaded document knowledge requires Business or Enterprise.