API Keys

Key Types

FlowSearch uses two types of API keys:

Getting Your API Keys

1. Log in to your FlowSearch dashboard
2. Select your website
3. Click the "Integration" tab
4. Your Search Key is displayed and ready to copy
5. Admin Keys can be viewed/created in the security section

Using Your Search Key

The Search Key is used in your frontend code:

<script>
  const flowSearch = new FlowSearch({
    apiUrl: 'https://api.flowsearch.io',
    apiKey: 'fs_pk_xxxxxxxxxxxxxxxxxxxx'  // Search Key
  });
  flowSearch.init();
</script>

Origin Restrictions

Protect your Search Key by restricting which domains can use it:

1. Go to your website settings
2. Find the "Allowed Origins" section
3. Add your domain(s):

# Example allowed origins
https://yoursite.com
https://www.yoursite.com
https://yoursite.webflow.io

Requests from other domains will be rejected, even with a valid API key.

Rate Limiting

API keys have rate limits based on your plan:

Regenerating Keys

If you suspect a key has been compromised:

1. Go to your website's Integration tab
2. Click "Regenerate Key"
3. Update your code with the new key
4. The old key is immediately invalidated

Best Practices

For Search Keys

• Always set origin restrictions for production
• Use different keys for staging and production
• Monitor usage in your dashboard

For Admin Keys

• Never commit to version control
• Use environment variables
• Rotate regularly (every 90 days recommended)
• Use the principle of least privilege

# Store in environment variables
# .env (never commit this file!)
FLOWSEARCH_ADMIN_KEY=fs_sk_xxxxxxxxxxxxxxxxxxxx

# Access in your code
const adminKey = process.env.FLOWSEARCH_ADMIN_KEY;

Key Permissions

Next Steps

• View your API keys in the dashboard
• Learn about the API
• Troubleshoot API issues