API Keys

API keys authenticate the GameFlow CLI and any direct calls to the GameFlow API. You can hold up to three at a time, so a CI pipeline, a deploy script and a laptop can each carry their own credential instead of sharing one.

Manage them from the dashboard at Settings → API Keys.

warning

A key grants full API access to your organization. Treat it like a password, never commit it to source control or expose it in client-side code.

Creating a key

Click Create Key and fill in:

• Name, required. What the key is for, for example CI pipeline.
• Description, optional.
• Expires, a span in minutes, hours or days, or tick Never expires.

The secret is shown once, on the screen that follows. Copy it then. Only a hash of the key is stored, so the plaintext cannot be shown again, and a key you failed to copy has to be rotated before it is usable.

Prefer an expiry. A key that expires on its own bounds how long a leaked secret is worth anything, and expired keys stop counting against your three slots.

The three-key limit

You may hold three keys that can still authenticate. A key stops occupying a slot once it has expired or once its revocation has landed, so you free a slot by letting a key expire or by revoking it, not by tidying the list.

The list shows every key you have ever created, newest first, including the dead ones. Nothing is deleted: the record that a key existed is part of the audit trail.

Each key shows one of four statuses:

Status	Means
Active	Authenticates today, with nothing scheduled against it.
Revoking	Revocation is scheduled but has not landed. Still authenticates, still occupies a slot.
Revoked	Revocation landed. No longer authenticates.
Expired	Reached its expiry without being revoked. No longer authenticates.

The status is derived from the key's timestamps rather than stored alongside them, so it can never disagree with whether the key actually works.

Using a key

Install the CLI and log in with the key:

curl -fsSL https://install.gameflow.gg | sh && \
  gameflow login --api-key <YOUR_API_KEY>

The CLI stores the key locally and uses it for every subsequent command. For CI/CD, pass it with --api-key from your platform's secret store rather than committing it.

For direct API calls, send the key in the x-api-key header:

curl https://api.gameflow.gg/v1/games \
  -H "x-api-key: <YOUR_API_KEY>"

Rotating a key

Rotate issues a new secret for an existing key. The old secret stops working immediately, and the key keeps its name, description and expiry rather than taking a second slot.

The new secret is shown once, the same as at creation.

Rotate when the secret may have been exposed but the key itself is still the right one, for instance the credential a long-lived pipeline uses. There is no overlap window, so update that pipeline in the same change.

Revoking a key

Revoke ends a key for good. You choose when:

• Revoke now, it stops authenticating immediately.
• Revoke later, it keeps working for a span you pick, then stops.

Revoke later is there for migrations: schedule the old key to stop in a day, create the new one, move your automation across, and nothing breaks in the gap. A key counting down still occupies one of your three slots until the revocation lands.

Revoking cannot be undone and a revoked key cannot be reactivated. Create a new key instead.

Revoke when:

• A key may have been exposed and you want it gone rather than rotated.
• The pipeline or script that used it no longer exists.
• Someone with access to it leaves.

Where a key fits

• CLI, gameflow login --api-key … uses it for every subsequent command (builds create, servers allocate, and so on).
• API, sent in the x-api-key header on the endpoints in the API Reference.
• Dashboard, does not use an API key. The dashboard authenticates with your sign-in session.