Install keys

Your install key (API key) is what lets the runtime load your flows. The Install page is where you find your snippet, manage keys, and control which domains can use them.

The Install page

Open Install from the sidebar. You will find:

• Your install snippet - copy it into your app. See Install Onbixo.
• Your API keys - create new ones and revoke old ones.
• Your allowed origins - the domains permitted to load your flows.

Allowed origins

For security, a key only serves flows on the domains you approve. Add your production and staging domains so the runtime can load flows there. Requests from any other origin are rejected. This means a leaked key cannot be used to serve your flows on someone else's site.

Revoking a key

If a key is exposed, revoke it from the Install page and switch your snippet to a new one. Revoked keys stop working immediately.

The browser extension

To build flows by clicking elements on your live app, pair the browser extension from the Install page. Pairing mints a one-time code that the extension trades for a scoped token - stored only in the extension, never in a web page - that can only save flow drafts to your account.