Version: 0.1.0

workflow-code API

The Workflow Server REST API supports email/password sessions, administrator-key recovery sessions, and browser approval for device flow. CLI and Desktop use device flow to exchange a per-device API Key; automation may also use Authorization: Bearer <token>. Embed and Webhook use separate tokens or secrets.

Authentication

HTTP: Bearer Auth

Use WORKFLOW_SERVER_ADMIN_KEY or the created account API Key.

Security Scheme Type:	http
HTTP Authorization Scheme:	bearer

HTTP: Bearer Auth

A wfpk_* Key dedicated to the current user and Conversation project; administrator and account API Keys cannot replace it.

Security Scheme Type:	http
HTTP Authorization Scheme:	bearer

API Key: WorkflowSessionCookie

A httpOnly browser session established by password login or administrator key login.

Security Scheme Type:	apiKey
Cookie parameter name:	workflow_auth_session

API Key: EmbedToken

Embed token; can also be passed in through token of query/body.

Security Scheme Type:	apiKey
Header parameter name:	x-workflow-embed-token

API Key: WebhookSecret

Webhook secret.

Security Scheme Type:	apiKey
Header parameter name:	x-workflow-webhook-secret

HTTP: Bearer Auth

GET /api/auth/sub2api/llm-credentials issued one-hour wfllm_ short credentials.

Security Scheme Type:	http
HTTP Authorization Scheme:	bearer

API Key: Sub2ApiLLMProxyApiKey

Anthropic SDK compatible entry; the value is also the one-hour wfllm_ short credential, not the real Sub2API Key.

Security Scheme Type:	apiKey
Header parameter name:	x-api-key

API Key: GitLabWebhookSecret

The GitLab Project Hook compatible header.

Security Scheme Type:	apiKey
Header parameter name:	x-gitlab-token