Flowise agent API key security: scoping and capping tool calls

How Flowise agents access vendor API keys

Flowise (the visual LangChain builder, 30K+ GitHub stars) lets you build agents by dragging nodes onto a canvas. When you add a tool node — Custom Tool, HTTP Tool, or a community integration — you either embed the API key directly in the tool's configuration or reference a Flowise credential from the credential manager.

The credential manager encrypts keys at rest and lets you reference them across multiple nodes. When the agent decides to invoke a tool, Flowise resolves the credential and injects it into the outgoing request. From the agent's perspective, it calls the tool; from the infrastructure perspective, the real Stripe key goes out in the Authorization header.

That credential is shared: every conversation using this flow, every user of a shared chatbot, every API call through the Flowise prediction endpoint uses the same underlying key. There's no per-conversation or per-user key isolation built in.

Four failure scenarios the shared credential model creates

Adding a vault key to a Flowise Custom Tool node

The most flexible approach in Flowise is the Custom Tool (JavaScript function tool). You write the tool logic in the Flowise UI; inside that function, you call the vendor API. Switching to a vault key requires changing two lines:

Before (direct Stripe):

// Flowise Custom Tool — JavaScript
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);  // real key
const intent = await stripe.paymentIntents.create({
  amount: params.amount_cents,
  currency: 'usd',
  customer: params.customer_id,
});
return intent.id;

After (vault key proxy):

// Flowise Custom Tool — JavaScript
const stripe = require('stripe')(process.env.VAULT_KEY);   // scoped vault key
stripe.setApiBase('https://proxy.keybrake.com/stripe');     // proxy base URL
const intent = await stripe.paymentIntents.create({
  amount: params.amount_cents,
  currency: 'usd',
  customer: params.customer_id,
});
return intent.id;

The vault key is issued per conversation (or per flow) via a prior HTTP call to Keybrake's key issuance endpoint. For per-conversation isolation, issue the key in a customFunction node at the start of the chain and inject it into the tool's environment:

// Flowise customFunction node — issue vault key at chain start
const res = await fetch('https://proxy.keybrake.com/vault/keys', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.KEYBRAKE_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    vendor: 'stripe',
    daily_usd_cap: 200,
    allowed_endpoints: ['POST /v1/payment_intents', 'GET /v1/customers/*'],
    expires_in: '1h',
    agent_run_label: `flowise/${$session_id}`,
  }),
});
const { vault_key } = await res.json();
process.env.VAULT_KEY = vault_key;  // available to downstream tool nodes in this chain
return vault_key;

Each conversation gets its own vault key, its own $200/day cap, and its own audit trail segment labeled with the session ID. If a conversation goes sideways, revoking that session's vault key takes one dashboard click or one API call — without touching the shared Keybrake API key that other conversations are using.

Multi-user Flowise deployments

If you deploy Flowise as a shared chatbot (via the embedded chat widget or the prediction API), the per-conversation vault key pattern gives you per-user spend isolation without requiring separate Flowise instances. Each call to the prediction API triggers a new conversation, which issues a new vault key with its own cap. The Keybrake audit log lets you filter by agent_run_label to see exactly what each conversation spent — useful for multi-tenant scenarios where you're tracking usage by customer.

How Keybrake fits

Keybrake is the proxy layer between Flowise's Custom Tool nodes and Stripe, Twilio, or Resend. You change the API key environment variable to a vault key and the base URL to the proxy endpoint. The real vendor keys stay on the Keybrake side, never in Flowise's environment. Per-conversation spend caps, endpoint allowlists, one-click revoke, and a queryable per-call audit log with session context are all included.

Get early access

Related questions

Further reading

• Dify agent API key security — the same credential isolation problem in Dify, with per-conversation vault key issuance via the Chatflow API.
• CrewAI API key management — per-agent key isolation in multi-agent CrewAI setups and why one shared key per crew is a risk.
• AI agent kill switch patterns — the four revocation mechanisms and which one is fast enough to stop a stuck agent mid-conversation.
• AI agent audit trail schema — the structured per-call log fields that make post-incident review useful, especially for multi-user chatbot deployments.