Service account & API key
The machine identity your backend uses to call FlozentAi.
A service account is how your own servers authenticate to FlozentAi. It is environment scoped, and it carries an explicit permission allowlist. Anything not on that list is denied, and a token exchange can never request more than the account was granted.
Keys
- A key is shown exactly once, at creation or rotation. It is stored only as a digest, so it cannot be recovered.
- Rotating issues a new key and shows it once. The old key keeps working until you revoke it, so there is no downtime.
- Revoking takes effect immediately and cannot be undone.
Permissions
Permissions are a comma-separated allowlist such as customers.read, invoices.draft. Grant the minimum the integration needs: the effective permission set of any run is the intersection of what it asked for and what this account holds.