Skip to main content

Developer

Everything you can do in Flowera's interface, you can do from code — run a flow, embed it, share it, and build flows programmatically.

Ways to use Flowera programmatically

You want to…Use
Run a flow from your backend and get the answerPrediction API
Put a chat widget on your websiteEmbed the chatbot
Send someone a link to a working botShare a link
Have a system push events into a flowCustom webhook
Create and edit flows from code or an AI assistantBuild via MCP
Keep a knowledge base in syncDocument store API

The distinction that matters is direction. The prediction API is you calling Flowera; a custom webhook is Flowera being called. Which one you want depends on who starts the interaction.

Authentication

All programmatic access uses a workspace API key in the Authorization header:

Authorization: Bearer <your_api_key_here>

A key is bound to one flow, not to the workspace as a whole. You attach a key to a flow, and only that key can call it — a key from a sibling flow in the same workspace gets a 401. Create one key per integration; when one leaks, you revoke one thing.

A flow with no key attached is callable by anyone who knows its ID

Attaching a key is opt-in. Until you do, the prediction endpoint for that flow accepts unauthenticated requests — convenient during development, an open invitation to spend your credits in production.

Requesting non-existent flow IDs is what gets an address blocked: three 404s within 15 minutes blocks it for an hour. A wrong key returns 401 and doesn't count toward that, but there's still no reason to retry one in a loop.

The two exceptions to bearer auth:

  • The embed widget carries a flow ID rather than a key. Anyone who can view your page can talk to the bot — see Embed.
  • A shared link with Make Public on needs no authentication at all.

Both are deliberate, and both mean the flow behind them is a public interface. Don't put anything in its prompt you wouldn't publish.

Costs apply

Every programmatic run costs credit exactly as an interface run does. A retry loop against a broken endpoint spends real money — check the Usage Dashboard after wiring up something new.

What lives elsewhere

In this section