Adding your API keys
Paste a provider key once; it is encrypted at rest, masked everywhere, and builders use it through a pool by name without ever seeing it.
In this article (5)
FlowArray runs on your own provider accounts. Adding a key is a one-time job for an owner or admin, and from then on the people building flows just choose a pool by name.
Adding one
API keys → provider, name, paste the key. Supported today:
| Provider | Used for |
|---|---|
| Google Gemini | Text, image generation, and Veo video (one key covers all three) |
| Anthropic | Claude text and vision — required for agent steps |
| OpenAI | Text |
| OpenRouter | One key, many models (Claude, GPT, Gemini) — and the only path that books actual charged cost |
| fal.ai | Image cleanup, upscaling, other hosted models |
| OpenAI-compatible | Any endpoint that speaks the OpenAI API |
Name it after the account it belongs to ("Studio account", "Client X's key") — that name is what shows up in run monitors and pool lists, and it is how you will tell two keys apart six months from now.
What happens to the key
- Encrypted at rest, and only ever decrypted to make the provider call.
- Masked everywhere in the interface — nobody, including you, reads it back out.
- Never put into a prompt, a log, an export, or a share. Not in an exported workflow file, not in a shared run, not in a notification.
- Members and viewers cannot see the API keys page at all, and the server refuses their requests to it regardless. They run flows through a pool by name. See Roles.
The two rate settings
- Requests per minute — how fast FlowArray may call this key. Leave blank for no cap.
- Parallel requests — how many calls may be in flight at once.
Set these from what your provider actually allows. They are what lets FlowArray hold work back before it becomes a rate-limit error, which is the difference between a batch that finishes and a batch that half-fails.
Shared account: the setting people skip
If two keys belong to the same provider account, organisation or project, they share one underlying rate limit. Give them the same Shared account name and FlowArray treats them as one bucket instead of assuming double capacity.
This matters because several providers meter per organisation or per project, not per key — OpenAI is per organisation, Gemini per Google Cloud project. Two keys from one project are one lane, and telling FlowArray otherwise just produces avoidable 429s.
Next
A key does nothing until it is in a pool — that is what a flow points at.