Agent keys

OAuth needs a browser. For agents that run without one, such as n8n, CI jobs, scripts or an agent on a server, use an agent key.

Create a key

1. Open Settings → Agent keys.
2. Name the key after where it will run (for example n8n or ci) and click Create.
3. Copy the key now: it starts with cvk_ and is shown only once. Floo stores only a hash of it.

Make one key per agent, so you can revoke them separately. You can have up to 25.

Use it

Send the key as a bearer token on every request, to either server:

Authorization: Bearer cvk_your_agent_key

Each client page shows where the header goes: Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI and other clients.

Call it from code

The servers are stateless: every request is a single JSON-RPC POST, with no session to open first.

curl -s https://worker.floo.design/mcp \
  -H "Authorization: Bearer $FLOO_AGENT_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_canvases","arguments":{}}}'

With the official TypeScript SDK:

import { Client } from '@modelcontextprotocol/sdk/client/index.js';
import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';

const transport = new StreamableHTTPClientTransport(
  new URL('https://worker.floo.design/mcp'),
  {
    requestInit: {
      headers: { Authorization: `Bearer ${process.env.FLOO_AGENT_KEY}` },
    },
  },
);

const client = new Client({ name: 'my-agent', version: '1.0.0' });

await client.connect(transport);

const { tools } = await client.listTools();

Keep keys safe

• A key acts as you, with exactly your access to canvases and teams. Treat it like a password: keep it in a secret store or an environment variable, never in a repository.
• Revoking a key in Settings → Agent keys stops that agent at once.
• Keys can't be created from an admin's impersonated session, and an account with multi-factor authentication must verify it first.