Keys and permissions
Send your Infinity Flow key in the header:
Authorization: Bearer YOUR_PRIVATE_KEYCreate a named key in Integrations. The complete secret appears once; subsequent views expose metadata and a prefix only. Default expiry is 90 days, configurable from 1 to 365 days. Each account supports up to 10 unexpired, non-revoked keys.
Every request checks current account status, scopes, base access and automation access. Keeping a key does not preserve access after suspension, plan expiry or add-on expiry.
Scopes
Section titled “Scopes”| Permission | Operations |
|---|---|
account:read |
Account, capabilities and models |
usage:read |
Usage and reset |
generations:read |
History, generation and batch reads |
generations:write |
Generation/batch creation and pre-submission cancellation |
projects:read |
Project listing and reads |
projects:write |
Project creation, rename and deletion |
references:read |
Private reference listing and reads |
references:write |
Upload/removal of unused references |
media:read |
Authorize playback, thumbnails and downloads |
Grant only the permissions a service needs. A results viewer does not need creation or deletion access.
Rotation
Section titled “Rotation”Create a new key, update your service secret, verify a read request and revoke the previous key in Integrations. Revocation never deletes accepted work or permits resubmitting it as a new generation. Retrieve saved IDs using a valid credential.
Request rates
Section titled “Request rates”Automation currently limits requests to 180 per minute per credential and 360 per minute per account. Daily usage, outstanding queue, pacing or maintenance may reject a request sooner. Follow Retry-After and the error code; creating more keys does not increase account capacity.
Do not use a browser session cookie as an API key. Browser pages retain their separate cookie/CSRF protections. Never forward your Bearer to a storage host when downloading private media.