Managing Credentials

FlowMint keeps service credentials apart from workflows, encrypted in the database, and never sends a stored value back out. There is no screen for entering them: you set them through FlowMint’s REST API, and the connector can list and test them.

The four keys

Key	Holds	Used by	Testable
`drive_service_account`	A Google service account’s JSON key, as text	Google Drive steps	Yes
`printavo_api_token`	JSON text with the Printavo account `email` and `token`	Printavo steps	Yes
`slack_webhook`	A Slack incoming-webhook address	Failure notifications	No
`notification_email`	An email address	Failure notifications	No

HTTP credentials

For an API an HTTP step calls, store the key under any name you choose as http_<name> — lowercase letters, digits and underscores:

curl -X PUT https://example.com/wp-json/flowmint/v1/connector/credentials/http_tickets \
  -u 'your-user:your-application-password' -H 'Content-Type: application/json' \
  -d '{"value": "the-api-key"}'

The step then names it in auth, and FlowMint adds it when the request is sent. HTTP credentials appear in the credential list by name, cannot be tested, and are removed like any other key. A step naming one that is not stored fails with credential_not_configured. Up to version 0.9.0 only the four keys above could be stored, so an HTTP step’s key had to be typed into the workflow.

Before you start

The connector must be switched on: FlowMint Workflows → Connector, Allow Claude Cowork to call this site. Every credential request is refused while it is off.
You need a user with the flowmint_manage_workflows capability (administrators have it) and an application password for that user, from Users → Profile → Application Passwords.

How to store a credential

Send the value as text in a PUT request:

curl -X PUT https://example.com/wp-json/flowmint/v1/connector/credentials/notification_email \
  -u 'your-username:xxxx xxxx xxxx xxxx xxxx xxxx' \
  -H 'Content-Type: application/json' \
  --data '{"value":"alerts@example.com"}'

The answer is {"success":true,"data":{"key":"notification_email","configured":true}}. Storing a key again replaces it. For a value that is itself JSON, such as the Drive key file, let a tool do the quoting:

jq -Rs '{value: .}' service-account.json | curl -X PUT \
  https://example.com/wp-json/flowmint/v1/connector/credentials/drive_service_account \
  -u 'your-username:xxxx xxxx xxxx xxxx xxxx xxxx' \
  -H 'Content-Type: application/json' --data @-

How to check and test

List: GET …/credentials, or ask the assistant (flowmint_list_credentials). Each key shows configured and testable, never the value.
Test: POST …/credentials/<key>/test, or flowmint_test_credential. The answer has test_result ok with details, or failed with error_code and error. What each test proves is on the Google Drive and Printavo pages.

How to remove a credential

Send DELETE …/credentials/<key>, or store an empty value. Workflows that need it then fail with credential_not_configured.

How they are protected

Each value is encrypted with AES-256-GCM before it is saved in the wp_options table. The encryption key is derived from the site’s AUTH_KEY and AUTH_SALT security keys plus a random value FlowMint creates on first use. The REST API and the connector report only whether a key is set.

For developers

The fmw_credential filter can supply a value, for example from a constant in wp-config.php, instead of the stored one: return a string for the key you handle and null otherwise. Steps use the filtered value, but the list, the tests and the Slack alert check only what is stored.