API Access

XainFlow provides a REST API that lets you interact with your workspace programmatically. Use API keys to authenticate requests from scripts, automations, CI/CD pipelines, or any HTTP client.

Requirements

Requirement	Details
Plan	Pro, Scale, Team, Business, or Enterprise
Role	Owner or Admin (to create and manage keys)

info

API access is not available on Free or Starter plans. Upgrade to Pro or above to enable programmatic access.

Creating an API Key

1. Navigate to Workspace Settings > API Keys.
2. Click Create API Key.
3. Enter a descriptive name (e.g., "MCP Production Key").
4. Select the scopes your key needs (see below).
5. Optionally set an expiration period.
6. Click Create and copy the key immediately.

warning

Your API key is shown only once. Store it securely. If you lose it, revoke the old key and create a new one.

API Key Format

All XainFlow API keys start with the prefix xf_live_. Each key is scoped to a single workspace — you never need to pass a workspace ID in your requests.

Scopes

Scopes control what operations an API key can perform.

Scope	What It Enables
read	List and get workspaces, projects, assets, styles, variables, credits, workflows, templates, runs, skills
write	Create, move, rename, delete assets, folders, projects, workflows, skills; upload images; clone templates
generate	Generate images, execute workflows, and use AI Suite tools (remove background, upscale, vectorize, expand, multi-angle)
admin	Manage API keys

tip

For most use cases, select read, write, and generate. Only add admin if the key needs to manage other API keys.

Authentication

Include your API key in every request using one of these headers:

# Option 1: X-API-Key header
curl -H "X-API-Key: xf_live_YOUR_KEY" \
  https://api.xainflow.com/functions/v1/api-list-projects

# Option 2: Authorization header
curl -H "Authorization: Bearer xf_live_YOUR_KEY" \
  https://api.xainflow.com/functions/v1/api-list-projects

Rate Limits

Limit	Default
Per minute	30 requests
Per day	1,000 requests

Exceeding rate limits returns a 429 response with error code RATE_LIMITED. Wait 60 seconds before retrying.

Response Format

All API endpoints return a consistent JSON structure:

Success:

{
  "success": true,
  "data": { ... },
  "pagination": { "total": 150, "limit": 20, "offset": 0, "has_more": true }
}

Error:

{
  "success": false,
  "error": "Human-readable message",
  "error_code": "VALIDATION_ERROR"
}

Error Codes

Code	HTTP	Description
UNAUTHORIZED	401	Missing or invalid authorization
INVALID_API_KEY	401	Key not found, revoked, or expired
INSUFFICIENT_SCOPES	403	Key missing required scope
PLAN_RESTRICTED	403	Workspace plan doesn't support API
RATE_LIMITED	429	Rate limit exceeded
INSUFFICIENT_CREDITS	402	Not enough credits
VALIDATION_ERROR	400	Invalid request parameters
NOT_FOUND	404	Resource not found
PROVIDER_ERROR	502	AI provider error

Available Endpoints

The API provides 27 endpoints covering all major features:

Category	Endpoints	Scope
Workspace	Get workspace, get credits	read
Projects	List projects, create project	read / write
Assets	List assets, manage assets, upload image	read / write
Styles & Variables	List styles, list variables	read
Image Generation	Generate image (7 models)	generate
Workflows	List, get, create, update, delete workflows; list templates; clone template; execute workflow; list/get runs	read / write / generate
AI Suite	Remove background, upscale, vectorize, image expand, multi-angle	generate
Skills	List, get, create skills	read / write

Managing Keys

From Workspace Settings > API Keys, you can:

• View all active keys with their scopes, creation date, and last used date.
• Revoke a key to immediately disable it.
• Update a key's name or scopes.

Related Pages

• MCP Server -- use the API through AI assistants
• Skills -- reusable instruction sets for AI agents
• Plans Overview -- see which plans include API access