Authentication - V-Run Docs

API key authentication

Every workflow in V-Run has a unique API key. This key authenticates external requests to trigger that workflow.

Finding your API key

Open the workflow in the editor.
Switch to the API Trigger tab in the left panel.
Your API key is displayed and can be copied.

Using the API key

Pass the key in the x-api-key header on every request:

curl -X POST https://run.virtualityhub.com/api/workflows/{workflowId}/execute \
  -H "x-api-key: wk_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{"input_param": "value"}'

import requests

response = requests.post(
    "https://run.virtualityhub.com/api/workflows/{workflowId}/execute",
    headers={
        "x-api-key": "wk_abc123def456",
        "Content-Type": "application/json",
    },
    json={"input_param": "value"},
)

print(response.json())

const response = await fetch(
  "https://run.virtualityhub.com/api/workflows/{workflowId}/execute",
  {
    method: "POST",
    headers: {
      "x-api-key": "wk_abc123def456",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ input_param: "value" }),
  }
);

const data = await response.json();
console.log(data);

curl -X POST \
  https://run.virtualityhub.com/api/workflows/{workflowId}/execute \
  -H "x-api-key: wk_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{"input_param": "value"}'

Security best practices

Treat your API key like a password. Never commit it to source control, embed it in client-side code, or share it publicly.

Store keys in environment variables on your server, not in code.
Rotate keys if you suspect they have been compromised. Generate a new key from the workflow editor.
Use HTTPS only — all API traffic must use TLS encryption.
Scope access — each workflow has its own key, so a compromised key only affects one workflow.