If your Alloy instance doesn't have API Keys enabled, you can still access Alloy's API using Workflow Tokens and Secrets as your authentication credentials.
Accessing Workflow Tokens and Secrets
To find your workflow authentication credentials:
Navigate to the Workflows section in your Alloy dashboard
Click on any workflow (such as "Fraud & CIP")
Look for the API Resources section in the top right of the workflow page
Your Workflow Token and Workflow Secret will be displayed there
Using Workflow Credentials for API Authentication
Any Workflow Token and Secret from your Alloy instance can be used to authenticate API requests. These credentials work with basic HTTP authentication where:
The username is your Workflow Token
The password is your Workflow Secret
Required Permissions
To view workflow tokens and secrets, users need the "Agent can view workflow tokens and secrets (workflow secrets grant full API access)" permission enabled in their account.
Important Security Note
Workflow secrets provide full API access to your account, so treat them as sensitive credentials and follow proper security practices.
For detailed authentication examples and implementation guidance, see the Authentication Guide.