docs: add required API key headers for 1.5 (#8721)

* add-api-key-header-to-examples * api-examples-add-keys * auth-login-behavior-changes * no-all-endpoint * syntax * text * cleanup * notice-for-mcp * include-instructions-for-exporting-key * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> * chat-io-double-quotes * auth-page-docs-review * docs-review * update-api-overview-page-docs-review * docs-and-eng-review * details-title * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> * docs-review * add-env-var-to-table * clarify-cli-key-requirements * docs: update API key creation instructions in CLI documentation - Changed the requirement for creating API keys from needing superuser status to allowing `AUTO_LOGIN` to be set to `TRUE`. - Added a reference to the API keys documentation for additional information. - Updated command examples for clarity. * public-server-update-env-vars * reference-page * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> * Apply suggestions from code review * Apply suggestions from code review * Apply suggestions from code review --------- Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
2025-07-10 11:20:35 -04:00 · 2025-07-10 11:20:35 -04:00 · 10c788af67
commit 10c788af67
parent ea6bbc7666
22 changed files with 362 additions and 178 deletions
--- a/docs/docs/API-Reference/api-build.md
+++ b/docs/docs/API-Reference/api-build.md
@ -32,6 +32,7 @@ curl -X POST \
  "$LANGFLOW_URL/api/v1/build/$FLOW_ID/flow" \
  -H "accept: application/json" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
    "inputs": {
      "input_value": "Tell me a story"
@ -59,7 +60,8 @@ curl -X POST \
 ```text
 curl -X GET \
  "$LANGFLOW_URL/api/v1/build/123e4567-e89b-12d3-a456-426614174000/events" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

   </TabItem>
@ -84,7 +86,8 @@ To disable streaming and get all events at once, set `stream` to `false`.
 ```text
 curl -X GET \
  "$LANGFLOW_URL/api/v1/build/123e4567-e89b-12d3-a456-426614174000/events?stream=false" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 ## Build headers
@ -134,6 +137,7 @@ curl -X POST \
  "$LANGFLOW_URL/api/v1/build/$FLOW_ID/flow" \
  -H "accept: application/json" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
    "data": {
      "nodes": [],
--- a/docs/docs/API-Reference/api-files.md
+++ b/docs/docs/API-Reference/api-files.md
@ -43,6 +43,7 @@ curl -X POST \
  "$LANGFLOW_URL/api/v1/files/upload/$FLOW_ID" \
  -H "accept: application/json" \
  -H "Content-Type: multipart/form-data" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -F "file=@FILE_NAME.txt"
 ```

@ -72,6 +73,7 @@ For more information, see [Supported environment variables](/environment-variabl
 ```bash
 curl -X POST "$LANGFLOW_URL/api/v1/files/upload/a430cc57-06bb-4c11-be39-d3d4de68d2c4" \
  -H "Content-Type: multipart/form-data" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -F "file=@FILE_NAME.png"
 ```

@ -91,7 +93,8 @@ The API returns the image file path in the format `"file_path":"<YOUR-FLOW-ID>/<
 ```bash
 curl -X POST \
    "$LANGFLOW_URL/api/v1/run/a430cc57-06bb-4c11-be39-d3d4de68d2c4?stream=false" \
-    -H 'Content-Type: application/json'\
+    -H 'Content-Type: application/json' \
+    -H "x-api-key: $LANGFLOW_API_KEY" \
    -d '{
    "output_type": "chat",
    "input_type": "chat",
@ -119,7 +122,8 @@ List all files associated with a specific flow.
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/files/list/$FLOW_ID" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -145,6 +149,7 @@ Download a specific file from a flow.
 curl -X GET \
  "$LANGFLOW_URL/api/v1/files/download/$FLOW_ID/2024-12-30_15-19-43_your_file.txt" \
  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  --output downloaded_file.txt
 ```

@ -168,7 +173,8 @@ Delete a specific file from a flow.
 ```bash
 curl -X DELETE \
  "$LANGFLOW_URL/api/v1/files/delete/$FLOW_ID/2024-12-30_15-19-43_your_file.txt" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -200,7 +206,8 @@ To retrieve your current `user_id`, call the `/whoami` endpoint.
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/users/whoami" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 Result:
@ -279,6 +286,7 @@ In this example, the file uploaded to `/v2/files` is included with the `/v1/run`
 curl --request POST \
  --url "$LANGFLOW_URL/api/v1/run/$FLOW_ID" \
  --header "Content-Type: application/json" \
+  --header "x-api-key: $LANGFLOW_API_KEY" \
  --data '{
  "input_value": "what do you see?",
  "output_type": "chat",
--- a/docs/docs/API-Reference/api-flows-run.md
+++ b/docs/docs/API-Reference/api-flows-run.md
@ -22,6 +22,7 @@ This flow requires a chat input string (`input_value`), and uses default values
 curl -X POST \
  "$LANGFLOW_SERVER_URL/api/v1/run/$FLOW_ID" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
    "input_value": "Tell me about something interesting!",
    "session_id": "chat-123",
@ -86,6 +87,7 @@ curl -X POST \
  "$LANGFLOW_SERVER_URL/api/v1/run/$FLOW_ID?stream=true" \
  -H "accept: application/json" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
    "message": "Tell me something interesting!",
    "session_id": "chat-123"
@ -152,7 +154,7 @@ curl -X POST \
  "$LANGFLOW_SERVER_URL/api/v1/run/$FLOW_ID?stream=true" \
  -H "Content-Type: application/json" \
  -H "accept: application/json" \
-  -H "x-api-key: sk-..." \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
    "input_value": "Tell me a story",
    "input_type": "chat",
@ -179,6 +181,7 @@ After you add a **Webhook** component to a flow, open the [**API access** pane](
 curl -X POST \
  "$LANGFLOW_SERVER_URL/api/v1/webhook/$FLOW_ID" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{"data": "example-data"}'
 ```

--- a/docs/docs/API-Reference/api-flows.md
+++ b/docs/docs/API-Reference/api-flows.md
@ -22,6 +22,7 @@ curl -X POST \
  "$LANGFLOW_URL/api/v1/flows/" \
  -H "accept: application/json" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
  "name": "string2",
  "description": "string",
@ -74,6 +75,7 @@ curl -X POST \
  "$LANGFLOW_URL/api/v1/flows/batch/" \
  -H "accept: application/json" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
  "flows": [
    {
@ -126,7 +128,8 @@ Retrieves a specific flow by its ID.
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/flows/$FLOW_ID" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -160,7 +163,8 @@ Retrieve all flows with pagination:
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/flows/?remove_example_flows=false&components_only=false&get_all=true&header_flows=false&page=1&size=50" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 To retrieve flows from a specific project, use the `project_id` query parameter:
@ -168,7 +172,8 @@ To retrieve flows from a specific project, use the `project_id` query parameter:
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/flows/?remove_example_flows=true&components_only=false&get_all=false&project_id=$PROJECT_ID&header_flows=false&page=1&size=1" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 ## Read sample flows
@ -178,7 +183,8 @@ Retrieves a list of sample flows:
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/flows/basic_examples/" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 ## Update flow
@ -195,6 +201,7 @@ curl -X PATCH \
  "$LANGFLOW_URL/api/v1/flows/$FLOW_ID" \
  -H "accept: application/json" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
  "name": "string",
  "description": "string",
@ -241,7 +248,8 @@ Deletes a specific flow by its ID.
 ```bash
 curl -X DELETE \
  "$LANGFLOW_URL/api/v1/flows/$FLOW_ID" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 </TabItem>
@ -271,6 +279,7 @@ curl -X POST \
  "$LANGFLOW_URL/api/v1/flows/download/" \
  -H "accept: application/json" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '[
  "e1e40c77-0541-41a9-88ab-ddb3419398b5",
  "92f9a4c5-cfc8-4656-ae63-1f0881163c28"
@ -307,6 +316,7 @@ curl -X POST \
  "$LANGFLOW_URL/api/v1/flows/upload/?project_id=$PROJECT_ID" \
  -H "accept: application/json" \
  -H "Content-Type: multipart/form-data" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -F "file=@agent-with-astra-db-tool.json;type=application/json"
 ```

--- a/docs/docs/API-Reference/api-logs.md
+++ b/docs/docs/API-Reference/api-logs.md
@ -38,7 +38,8 @@ Stream logs in real-time using Server Sent Events (SSE).
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/logs-stream" \
-  -H "accept: text/event-stream"
+  -H "accept: text/event-stream" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -84,7 +85,8 @@ With default values, the endpoint returns the last 10 lines of logs.
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/logs?lines_before=0&lines_after=0&timestamp=0" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
--- a/docs/docs/API-Reference/api-monitor.md
+++ b/docs/docs/API-Reference/api-monitor.md
@ -18,7 +18,8 @@ Retrieve Vertex builds for a specific flow.
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/monitor/builds?flow_id=$FLOW_ID" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -397,7 +398,8 @@ Delete Vertex builds for a specific flow.
 ```bash
 curl -X DELETE \
  "$LANGFLOW_URL/api/v1/monitor/builds?flow_id=$FLOW_ID" \
-  -H "accept: */*"
+  -H "accept: */*" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -417,7 +419,8 @@ Retrieve a list of all messages:
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/monitor/messages" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 To filter messages, use the `flow_id`, `session_id`, `sender`, and `sender_name` query parameters.
@ -432,7 +435,8 @@ This example retrieves messages sent by `Machine` and `AI` in a given chat sessi
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/monitor/messages?flow_id=$FLOW_ID&session_id=01ce083d-748b-4b8d-97b6-33adbb6a528a&sender=Machine&sender_name=AI&order_by=timestamp" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -488,6 +492,7 @@ curl -v -X DELETE \
  "$LANGFLOW_URL/api/v1/monitor/messages" \
  -H "accept: */*" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '["MESSAGE_ID_1", "MESSAGE_ID_2"]'
 ```

@ -515,6 +520,7 @@ curl -X PUT \
  "$LANGFLOW_URL/api/v1/monitor/messages/3ab66cc6-c048-48f8-ab07-570f5af7b160" \
  -H "accept: application/json" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
  "text": "testing 1234"
 }'
@ -566,7 +572,8 @@ This example updates the `session_ID` value `01ce083d-748b-4b8d-97b6-33adbb6a528
 ```bash
 curl -X PATCH \
  "$LANGFLOW_URL/api/v1/monitor/messages/session/01ce083d-748b-4b8d-97b6-33adbb6a528a?new_session_id=different_session_id" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -618,7 +625,8 @@ Delete all messages for a specific session.
 ```bash
 curl -X DELETE \
  "$LANGFLOW_URL/api/v1/monitor/messages/session/different_session_id_2" \
-  -H "accept: */*"
+  -H "accept: */*" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -641,7 +649,8 @@ Retrieve all transactions, which are interactions between components, for a spec
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/monitor/transactions?flow_id=$FLOW_ID&page=1&size=50" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
--- a/docs/docs/API-Reference/api-projects.md
+++ b/docs/docs/API-Reference/api-projects.md
@ -20,7 +20,8 @@ Get a list of Langflow projects, including project IDs, names, and descriptions.
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/projects/" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -51,6 +52,7 @@ Create a new project.
 curl -X POST \
  "$LANGFLOW_URL/api/v1/projects/" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
  "name": "new_project_name",
  "description": "string",
@ -83,6 +85,7 @@ curl -X POST \
  "$LANGFLOW_URL/api/v1/projects/" \
  -H "accept: application/json" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
  "name": "new_project_name",
  "description": "string",
@ -107,7 +110,8 @@ To find the UUID of your project, call the [read projects](#read-projects) endpo
 ```bash
 curl -X GET \
  "$LANGFLOW_URL/api/v1/projects/$PROJECT_ID" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -142,6 +146,7 @@ If you send the same values multiple times, the update is still processed, even
 curl -X PATCH \
  "$LANGFLOW_URL/api/v1/projects/b408ddb9-6266-4431-9be8-e04a62758331" \
  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
  "name": "string",
  "description": "string",
@ -180,7 +185,8 @@ Delete a specific project.
 ```bash
 curl -X DELETE \
  "$LANGFLOW_URL/api/v1/projects/$PROJECT_ID" \
-  -H "accept: */*"
+  -H "accept: */*" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

  </TabItem>
@ -203,6 +209,7 @@ The `--output` flag is optional.
 curl -X GET \
  "$LANGFLOW_URL/api/v1/projects/download/b408ddb9-6266-4431-9be8-e04a62758331" \
  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  --output langflow-project.zip
 ```

@ -215,5 +222,6 @@ curl -X POST \
  "$LANGFLOW_URL/api/v1/projects/upload/" \
  -H "accept: application/json" \
  -H "Content-Type: multipart/form-data" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -F "file=@20241230_135006_langflow_flows.zip;type=application/zip"
 ```
--- a/docs/docs/API-Reference/api-reference-api-examples.md
+++ b/docs/docs/API-Reference/api-reference-api-examples.md
@ -47,40 +47,34 @@ curl --request POST \

 ### Base URL

-<!-- For 1.5
 By default, local deployments serve the Langflow API at `http://localhost:7860/api`.

 Remotely hosted Langflow deployments are available at the domain set by the hosting service, such as `http://IP_OR_DNS/api` or `http://IP_OR_DNS:LANGFLOW_PORT/api`.

 You can configure the Langflow port number in the `LANGFLOW_PORT` [environment variable](/environment-variables).
-->
-
-Local deployments serve the Langflow API at `http://localhost:LANGFLOW_PORT/api`.
-The default port is 7868 or 7860:
-
-* Local Langflow Desktop: `http://localhost:7868/api`
-* Local Langflow OSS: `http://localhost:7860/api`
-* Local Langflow Docker image: `http://localhost:7860/api`
-
-Remotely hosted Langflow deployments are available at the domain set by the hosting service.
-For example:

 * `https://UUID.ngrok.app/api`
 * `http://IP_OR_DNS/api`
 * `http://IP_OR_DNS:LANGFLOW_PORT/api`

-:::tip
-The Langflow port number is set in the `LANGFLOW_PORT` [environment variable](/environment-variables).
-::::
-
 ### Authentication

-Your [Langflow deployment's authentication settings](/configuration-authentication) determine whether Langflow API requests require explicit authentication with a Langflow API key.
+As of Langflow v1.5, all API requests require a Langflow API key, even when `AUTO_LOGIN` is enabled.

-If explicit authentication is required, you must provide a valid Langflow API key in either an `x-api-key` header or query parameter.
+The only exceptions are the MCP endpoints at `/v1/mcp`, `/v1/mcp-projects`, and `/v2/mcp`.
+These endpoints don't require authentication, regardless of the `AUTO_LOGIN` setting.
+
+You must provide a valid Langflow API key in either an `x-api-key` header or a query parameter.
 For more information, see [API keys](/configuration-api-keys).

-Because authentication isn't always required, Langflow API examples in the Langflow documentation often omit authentication.
+<details closed>
+<summary>Auto-login and API key authentication in earlier Langflow versions</summary>
+
+Prior to Langflow v1.5, when `AUTO_LOGIN` was enabled with `AUTO_LOGIN=true`, Langflow automatically logged users in as a superuser without requiring authentication, and API requests could be made without a Langflow API key.
+
+If you set `SKIP_AUTH_AUTO_LOGIN=true` and `AUTO_LOGIN=true`, authentication will be skipped entirely, and API requests will not require a Langflow API key.
+
+</details>

 As with any API, follow industry best practices for storing and referencing sensitive credentials.
 For example, you can [set environment variables](#set-environment-variables) for your API keys, and then reference those environment variables in your API requests.
@ -114,6 +108,8 @@ For example:
 export LANGFLOW_API_KEY="sk..."
 export LANGFLOW_SERVER_URL="https://localhost:7860"
 export FLOW_ID="359cd752-07ea-46f2-9d3b-a4407ef618da"
+export PROJECT_ID="1415de42-8f01-4f36-bf34-539f23e47466"
+export LANGFLOW_API_KEY="sk-..."

 # Use environment variables in API requests
 curl --request POST \
@ -140,8 +136,6 @@ You can retrieve flow IDs from the [**API access** pane](/concepts-publish#api-a

 Once you have your Langflow server URL, try calling these endpoints that return Langflow metadata.

-If authentication is required, include an `x-api-key` header or query parameter with a valid [Langflow API key](/configuration-api-keys), such as `-H 'x-api-key: $API_KEY'`.
-
 ### Get version

 Returns the current Langflow API version:
@ -150,6 +144,7 @@ Returns the current Langflow API version:
 curl -X GET \
  "$LANGFLOW_SERVER_URL/api/v1/version" \
  -H "accept: application/json"
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 <details>
@ -171,6 +166,7 @@ Returns configuration details for your Langflow deployment:
 curl -X GET \
  "$LANGFLOW_SERVER_URL/api/v1/config" \
  -H "accept: application/json"
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 <details>
@ -196,7 +192,8 @@ Returns a dictionary of all Langflow components:
 ```bash
 curl -X GET \
  "$LANGFLOW_SERVER_URL/api/v1/all" \
-  -H "accept: application/json"
+  -H "accept: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY"
 ```

 ## Next steps
--- a/docs/docs/API-Reference/api-users.md
+++ b/docs/docs/API-Reference/api-users.md
@ -24,6 +24,7 @@ This creates a new UUID for the user's `id`, which is mapped to `user_id` in the
 curl -X POST \
  "$LANGFLOW_URL/api/v1/users/" \
  -H "Content-Type: application/json" \
+  -H "x-api-key: $LANGFLOW_API_KEY" \
  -d '{
    "username": "newuser2",
    "password": "securepassword123"
--- a/docs/docs/Components/components-data.md
+++ b/docs/docs/Components/components-data.md
@ -421,16 +421,16 @@ This component defines a webhook trigger that runs a flow when it receives an HT

 If the input is not valid JSON, the component wraps it in a `payload` object so that it can be processed and still trigger the flow.

-When you add a **Webhook** component to a flow, the flow's [**API access** pane](/concepts-publish#api-access) exposes an additional **Webhook cURL** tab that contains a `POST /v1/webhook/$FLOW_ID` code snippet.
-You can use this request to send data to the **Webhook** component and trigger the flow.
-For example:
+When a **Webhook** component is added to the workspace, a new **Webhook cURL** tab becomes available in the **API** pane that contains an HTTP POST request for triggering the webhook component. For example:
+Replace `LANGFLOW_SERVER_ADDRESS`, `FLOW_ID`, and `LANGFLOW_API_KEY` with the values from your Langflow deployment.

 ```bash
 curl -X POST \
-  "$LANGFLOW_SERVER_URL/api/v1/webhook/$FLOW_ID" \
-  -H 'Content-Type: application/json'\
+  "http://LANGFLOW_SERVER_ADDRESS/api/v1/webhook/FLOW_ID" \
+  -H 'Content-Type: application/json' \
+  -H 'x-api-key: LANGFLOW_API_KEY' \
  -d '{"any": "data"}'
-  ```
+```

 The **Webhook** component is often paired with a [**Parser** component](/components-processing#parser) to extract relevant data from the raw payload.
 For more information, see [Trigger flows with webhooks](/webhook).
--- a/docs/docs/Components/components-io.md
+++ b/docs/docs/Components/components-io.md
@ -206,59 +206,70 @@ The output does not appear in the **Playground**.
 The **Chat Input** component is often the entry point for passing messages to the Langflow API.
 To send the same example messages programmatically to your Langflow server, do the following:

-1. To get your Langflow endpoint, click **Publish**, and then click **API access**.
+1. To get your Langflow endpoint, click **Share**, and then click **API access**.
 2. Copy the command from the **cURL** tab, and then paste it in your terminal.
-    It looks similar to this:
-    ```text
-    curl --request POST \
-      --url 'http://localhost:7860/api/v1/run/51eed711-4530-4fdc-9bce-5db4351cc73a?stream=false' \
-      --header 'Content-Type: application/json' \
-      --data '{
-      "input_value": "What's the recommended way to install Docker on Mac M1?",
-      "output_type": "chat",
-      "input_type": "chat"
-    }'
-    ```
+
+The values for `LANGFLOW_SERVER_ADDRESS`, `FLOW_ID`, and `LANGFLOW_API_KEY` are automatically completed with values from your Langflow deployment.
+If your values are different, you must replace them.
+```text
+curl --request POST \
+  --url "http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID" \
+  --header "Content-Type: application/json" \
+  --header "x-api-key: LANGFLOW_API_KEY" \
+  --data '{
+  "input_value": "What's the recommended way to install Docker on Mac M1?",
+  "output_type": "chat",
+  "input_type": "chat"
+}'
+```
+
 3. Modify `input_value` so it contains the question, `What's the recommended way to install Docker on Mac M1?`.

    Note the `output_type` and `input_type` parameters that are passed with the message. The `chat` type provides additional configuration options, and the messages appear in the **Playground**. The `text` type returns only text strings, and does not appear in the **Playground**.

 4. Add a custom `session_id` to the message's `data` object.
-    ```text
-    curl --request POST \
-      --url 'http://localhost:7860/api/v1/run/51eed711-4530-4fdc-9bce-5db4351cc73a?stream=false' \
-      --header 'Content-Type: application/json' \
-      --data '{
-      "input_value": "Whats the recommended way to install Docker on Mac M1",
-      "session_id": "docker-question-on-m1",
-      "output_type": "chat",
-      "input_type": "chat"
-    }'
-    ```
-    The custom `session_id` value starts a new chat session between your client and the Langflow server, and can be useful in keeping conversations and AI context separate.
+
+```text
+curl --request POST \
+  --url "http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID" \
+  --header "Content-Type: application/json" \
+  --header "x-api-key: LANGFLOW_API_KEY" \
+  --data '{
+  "input_value": "Whats the recommended way to install Docker on Mac M1",
+  "session_id": "docker-question-on-m1",
+  "output_type": "chat",
+  "input_type": "chat"
+}'
+```
+The custom `session_id` value starts a new chat session between your client and the Langflow server, and can be useful in keeping conversations and AI context separate.

 5. Send the POST request.
 Your request is answered.
 6. Navigate to the **Playground**.
 A new chat session called `docker-question-on-m1` has appeared, using your unique `session_id`.
-7. To modify additional parameters with **Tweaks** for your **Chat Input** and **Chat Output** components, click **Publish**, and then click **API access**.
-8. Click **Tweaks** to modify parameters in the component's `data` object.
-    For example, disabling storing messages from the **Chat Input** component adds a **Tweak** to your command:
-    ```text
-    curl --request POST \
-      --url 'http://localhost:7860/api/v1/run/51eed711-4530-4fdc-9bce-5db4351cc73a?stream=false' \
-      --header 'Content-Type: application/json' \
-      --data '{
-      "input_value": "Text to input to the flow",
-      "output_type": "chat",
-      "input_type": "chat",
-      "tweaks": {
-        "ChatInput-4WKag": {
-          "should_store_message": false
-        }
-      }
-    }'
-    ```
+7. To modify additional parameters with **Tweaks** for your **Chat Input** and **Chat Output** components, click **Share**, and then click **API access**.
+8. Click **Input schema** to modify parameters in the component's `data` object.
+For example, disabling storing messages from the **Chat Input** component adds a **Tweak** to your command:
+```text
+curl --request POST \
+  --url "http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID" \
+  --header "Content-Type: application/json" \
+  --header "x-api-key: LANGFLOW_API_KEY" \
+  --data '{
+  "input_value": "Text to input to the flow",
+  "output_type": "chat",
+  "input_type": "chat",
+  "tweaks": {
+    "ChatInput-4WKag": {
+      "should_store_message": false
+    }
+  }
+}'
+```

-    To confirm your command is using the tweak, navigate to the **Logs** pane and view the request from the **Chat Input** component.
-    The value for `should_store_message` is `false`.
+To confirm your command is using the tweak, navigate to the **Logs** pane and view the request from the **Chat Input** component.
+The value for `should_store_message` is `false`.
+
+## See also
+
+- [Session ID](/session-id)
--- a/docs/docs/Components/components-processing.md
+++ b/docs/docs/Components/components-processing.md
@ -70,34 +70,35 @@ This component performs operations on [Data](/concepts-objects#data-object) obje
 All operations in the component require at least one [Data](/concepts-objects#data-object) input.
 2. In the **Operations** field, select the operation you want to perform.
 For example, send this request to the **Webhook** component.
-Replace `YOUR_FLOW_ID` with your flow ID.
-    ```bash
-    curl -X POST "http://127.0.0.1:7860/api/v1/webhook/YOUR_FLOW_ID" \
-    -H 'Content-Type: application/json' \
-    -d '{
-      "id": 1,
-      "name": "Leanne Graham",
-      "username": "Bret",
-      "email": "Sincere@april.biz",
-      "address": {
-        "street": "Kulas Light",
-        "suite": "Apt. 556",
-        "city": "Gwenborough",
-        "zipcode": "92998-3874",
-        "geo": {
-          "lat": "-37.3159",
-          "lng": "81.1496"
-        }
-      },
-      "phone": "1-770-736-8031 x56442",
-      "website": "hildegard.org",
-      "company": {
-        "name": "Romaguera-Crona",
-        "catchPhrase": "Multi-layered client-server neural-net",
-        "bs": "harness real-time e-markets"
-      }
-    }'
-    ```
+Replace `FLOW_ID` and `LANGFLOW_API_KEY` with the values from your deployment.
+```bash
+curl -X POST "http://localhost:7860/api/v1/webhook/FLOW_ID" \
+-H 'Content-Type: application/json' \
+-H 'x-api-key: LANGFLOW_API_KEY' \
+-d '{
+  "id": 1,
+  "name": "Leanne Graham",
+  "username": "Bret",
+  "email": "Sincere@april.biz",
+  "address": {
+    "street": "Kulas Light",
+    "suite": "Apt. 556",
+    "city": "Gwenborough",
+    "zipcode": "92998-3874",
+    "geo": {
+      "lat": "-37.3159",
+      "lng": "81.1496"
+    }
+  },
+  "phone": "1-770-736-8031 x56442",
+  "website": "hildegard.org",
+  "company": {
+    "name": "Romaguera-Crona",
+    "catchPhrase": "Multi-layered client-server neural-net",
+    "bs": "harness real-time e-markets"
+  }
+}'
+```

 3. In the **Data Operations** component, select the **Select Keys** operation to extract specific user information.
 To add additional keys, click <Icon name="Plus" aria-hidden="True" /> **Add more**.
@ -176,17 +177,20 @@ Avoid punctuation in the **Instructions** field, as it can cause errors.
 5. To run the flow, in the **Smart Filter** component, click <Icon name="Play" aria-hidden="true" /> **Run component**.
 6. To inspect the filtered data, in the **Smart Filter** component, click <Icon name="TextSearch" aria-hidden="true" /> **Inspect output**.
 The result is a structured DataFrame.
+
 ```text
 id | name             | company               | username        | email                              | address           | zip
 ---|------------------|----------------------|-----------------|------------------------------------|-------------------|-------
 1  | Emily Johnson    | ABC Corporation      | emily_johnson   | emily.johnson@abccorporation.com   | 123 Main St       | 12345
 2  | Michael Williams | XYZ Corp             | michael_williams| michael.williams@xyzcorp.com       | 456 Elm Ave       | 67890
 ```
+
 7. Add the **DataFrame Operations** component, and a **Chat Output** component to the flow.
 8. In the **DataFrame Operations** component, in the **Operation** field, select **Filter**.
 9. To apply a filter, in the **Column Name** field, enter a column to filter on. This example filters by `name`.
 10. Click **Playground**, and then click **Run Flow**.
 The flow extracts the values from the `name` column.
+
 ```text
 name
 Emily Johnson
@ -467,6 +471,7 @@ This example uses the default Langflow server address.
 ```text
 curl -X POST "http://127.0.0.1:7860/api/v1/webhook/YOUR_FLOW_ID" \
 -H 'Content-Type: application/json' \
+-H 'x-api-key: LANGFLOW_API_KEY' \
 -d '{
    "Name": ["Alex Cruz", "Kalani Smith", "Noam Johnson"],
    "Role": ["Developer", "Designer", "Manager"],
--- a/docs/docs/Concepts/concepts-playground.md
+++ b/docs/docs/Concepts/concepts-playground.md
@ -50,12 +50,14 @@ The `session_id` value can be configured in the **Controls** of the **Chat Input

 To have more than one session in a single flow, pass a specific session ID to a flow with the `session_id` parameter in the URL. All the components in the flow will automatically use this `session_id` value.

-To post a message to a flow with a specific session ID with curl, enter the following command.
-Replace `CUSTOM_SESSION_VALUE` with the session ID you want to send the request to.
+
+To post a message to a flow with a specific Session ID with curl, enter the following command.
+Replace `LANGFLOW_SERVER_ADDRESS`, `FLOW_ID`, and `LANGFLOW_API_KEY` with the values from your Langflow deployment.

 ```bash
-   curl -X POST "http://localhost:7860/api/v1/run/$FLOW_ID" \
-   -H 'Content-Type: application/json' \
+   curl -X POST "http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID" \
+   -H "Content-Type: application/json" \
+   -H "x-api-key: LANGFLOW_API_KEY" \
   -d '{
       "session_id": "CUSTOM_SESSION_VALUE",
       "input_value": "message",
@ -85,10 +87,11 @@ You can work with base64 images in the Playground in several ways:
 * **Programmatic Input**: Send base64-encoded images through the API.

 This example sends a base64-encoded image to the Playground using curl:
-
+Replace `LANGFLOW_SERVER_ADDRESS`, `FLOW_ID`, and `LANGFLOW_API_KEY` with the values from your Langflow deployment.
 ```bash
-curl -X POST "http://localhost:7860/api/v1/run/$FLOW_ID" \
-H 'Content-Type: application/json' \
+curl -X POST "http://localhost:7860/api/v1/run/FLOW_ID" \
+-H "Content-Type: application/json" \
+-H "x-api-key: LANGFLOW_API_KEY" \
 -d '{
    "session_id": "custom_session_123",
    "input_value": "What is in this image?",
--- a/docs/docs/Concepts/concepts-publish.md
+++ b/docs/docs/Concepts/concepts-publish.md
@ -12,7 +12,13 @@ Langflow provides several ways to publish and integrate your flows into external

 Langflow provides code snippets to help you get started with the Langflow API.

-To access the **API access** pane, click **Share**, and then click **API access**.
+As of Langflow version 1.5, all API requests require authentication with a Langflow API key, even if `AUTO_LOGIN` is set to `True`.
+For more information, see [API keys](/configuration-api-keys).
+The API access pane’s code snippets include a script that looks for a `LANGFLOW_API_KEY` environment variable set in your terminal session.
+To set this variable in your terminal:
+```bash
+export LANGFLOW_API_KEY="sk..."
+```

 ![API pane](/img/api-pane.png)

--- a/docs/docs/Configuration/configuration-api-keys.md
+++ b/docs/docs/Configuration/configuration-api-keys.md
@ -7,37 +7,96 @@ import Tabs from '@theme/Tabs';
 import TabItem from '@theme/TabItem';
 import Icon from "@site/src/components/icon";

-Langflow provides an API key functionality that allows users to access their individual components and flows without traditional login authentication.
+You can use Langflow API keys to interact with Langflow programmatically.
+
+The API key has the same permissions and access as you do when you launch Langflow. This means your API key can only access your own flows, components, and data. You cannot access other users' resources with your own Langflow API keys.
+An API key represents the user who created it. If you create a key as a superuser, then that key will have superuser privileges.
+Anyone who has that key can authorize superuser actions through the Langflow API, including user management and flow management.
+
+In Langflow versions 1.5 and later, most API requests require a Langflow API key, even when `AUTO_LOGIN=true`.
+
+The only exceptions are the MCP endpoints: `/v1/mcp`, `/v1/mcp-projects`, and `/v2/mcp`.
+These endpoints don't require authentication, regardless of the `AUTO_LOGIN` setting.
+
+<details>
+<summary>Auto-login and API key authentication in earlier Langflow versions</summary>
+
+If you are running a Langflow version earlier than 1.5, if `AUTO_LOGIN=true`, Langflow automatically logs users in as a superuser without requiring authentication, and API requests can be made without a Langflow API key.
+
+If you set `SKIP_AUTH_AUTO_LOGIN=true` and `AUTO_LOGIN=true`, authentication will be skipped entirely, and API requests will not require a Langflow API key.
+
+</details>

 ## Generate a Langflow API key

-Generate a user-specific token to use with Langflow.
+You can generate a Langflow API key with the UI or the CLI.

-### Generate an API key with the Langflow UI
+The UI-generated key is appropriate for most cases. The CLI-generated key is needed when your Langflow server is running in `--backend-only` mode.
+
+<Tabs>
+  <TabItem value="Langflow UI" label="Langflow UI" default>

 1. Click your user icon, and then select **Settings**.
-2. Click **Langflow API**, and then click **Add New**.
-3. Name your key, and then click **Create Secret Key**.
+2. Click **Langflow API Keys**, and then click **Add New**.
+3. Name your key, and then click **Create API Key**.
 4. Copy the API key and store it in a secure location.

-### Generate an API key with the Langflow CLI
+  </TabItem>

-```shell
-langflow api-key
-# or
-python -m langflow api-key
-╭─────────────────────────────────────────────────────────────────────╮
-│ API Key Created Successfully:                                       │
-│                                                                     │
-│ sk-O0elzoWID1izAH8RUKrnnvyyMwIzHi2Wk-uXWoNJ2Ro                      │
-│                                                                     │
-│ This is the only time the API key will be displayed.                │
-│ Make sure to store it in a secure location.                         │
-│                                                                     │
-│ The API key has been copied to your clipboard. Cmd + V to paste it. │
-╰──────────────────────────────
+  <TabItem value="Langflow CLI" label="Langflow CLI">

-```
+If you're serving your flow with `--backend-only=true`, you can't create API keys in the UI, because the frontend is not running.
+
+Depending on your authentication settings, note the following requirements for creating API keys with the Langflow CLI:
+
+* If `AUTO_LOGIN` is `FALSE`, you must be logged in as a superuser.
+* If `AUTO LOGIN` is `TRUE`, you're already logged in as superuser.
+
+To create an API key for a user from the CLI, do the following:
+
+1. In your `.env` file, set `AUTO_LOGIN=FALSE`, and set superuser credentials for your server.
+
+    ```text
+    LANGFLOW_AUTO_LOGIN=False
+    LANGFLOW_SUPERUSER=administrator
+    LANGFLOW_SUPERUSER_PASSWORD=securepassword
+    ```
+
+2. To confirm your superuser status, call [`GET /users/whoami`](/api-users#get-current-user), and then check that the response contains `"is_superuser": true`:
+
+    ```bash
+    curl -X GET \
+      "$LANGFLOW_URL/api/v1/users/whoami" \
+      -H "accept: application/json" \
+      -H "x-api-key: $LANGFLOW_API_KEY"
+    ```
+
+    <details closed>
+    <summary>Result</summary>
+
+    ```json
+    {
+      "id": "07e5b864-e367-4f52-b647-a48035ae7e5e",
+      "username": "langflow",
+      "profile_image": null,
+      "store_api_key": null,
+      "is_active": true,
+      "is_superuser": true,
+      "create_at": "2025-05-08T17:59:07.855965",
+      "updated_at": "2025-05-29T15:06:56.157860",
+      "last_login_at": "2025-05-29T15:06:56.157016",
+    }
+    ```
+
+    </details>
+
+2. Create an API key:
+
+    ```shell
+    uv run langflow api-key
+    ```
+  </TabItem>
+</Tabs>

 ## Authenticate requests with the Langflow API key

@ -45,28 +104,32 @@ Include your API key in API requests to authenticate requests to Langflow.

 API keys allow access only to the flows and components of the specific user to whom the key was issued.

-### Include the API key in the HTTP header
+<Tabs>
+  <TabItem value="HTTP header" label="HTTP header" default>

 To use the API key when making API requests, include the API key in the HTTP header:

 ```shell
 curl -X POST \
-  "http://localhost:7860/api/v1/run/FLOW_ID?stream=false" \
+  "http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID?stream=false" \
  -H 'Content-Type: application/json' \
-  -H 'x-api-key: API_KEY' \
+  -H 'x-api-key: LANGFLOW_API_KEY' \
  -d '{"inputs": {"text":""}, "tweaks": {}}'
 ```

-### Include the API key as a query parameter
+  </TabItem>
+  <TabItem value="Query parameter" label="Query parameter">

 To pass the API key as a query parameter:

 ```shell
 curl -X POST \
-  "http://localhost:7860/api/v1/run/FLOW_ID?x-api-key=API_KEY?stream=false" \
+  "http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID?x-api-key=LANGFLOW_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"inputs": {"text":""}, "tweaks": {}}'
 ```
+  </TabItem>
+</Tabs>

 ## Generate a Langflow secret key

--- a/docs/docs/Configuration/configuration-authentication.md
+++ b/docs/docs/Configuration/configuration-authentication.md
@ -24,9 +24,19 @@ You can copy the contents of this file into your own `.env` file and replace the

 ### LANGFLOW_AUTO_LOGIN

-When `True`, Langflow automatically logs users in with username `langflow` and password `langflow` without requiring user authentication.
-To disable automatic login and enforce user authentication, set this value to `False` in your `.env` file.
-By default, this variable is set to `True`.
+In Langflow versions 1.5 and later, most API requests require a Langflow API key, even when `AUTO_LOGIN=true`.
+
+The only exceptions are the MCP endpoints: `/v1/mcp`, `/v1/mcp-projects`, and `/v2/mcp`.
+These endpoints don't require authentication, regardless of the `AUTO_LOGIN` setting.
+
+<details>
+<summary>Auto-login and API key authentication in earlier Langflow versions</summary>
+
+If you are running a Langflow version earlier than 1.5, if `AUTO_LOGIN=true`, Langflow automatically logs users in as a superuser without requiring authentication, and API requests can be made without a Langflow API key.
+
+If you set `SKIP_AUTH_AUTO_LOGIN=true`, authentication will be skipped entirely, and API requests will not require a Langflow API key, regardless of the `AUTO_LOGIN` setting.
+
+</details>

 Langflow **does not** allow users to have simultaneous or shared access to flows.
 If `AUTO_LOGIN` is enabled and user management is disabled (`LANGFLOW_NEW_USER_IS_ACTIVE=true`), users can access the same environment, but it is not password protected. If two users access the same flow, Langflow saves only the work of the last user to save.
--- a/docs/docs/Configuration/configuration-cli.md
+++ b/docs/docs/Configuration/configuration-cli.md
@ -33,12 +33,17 @@ python -m langflow [OPTIONS]

 ### langflow api-key

-Create an API key for the default superuser if the `LANGFLOW_AUTO_LOGIN` environment variable is set to `true`.
+To create API keys with the Langflow CLI, `AUTO_LOGIN` must be set to `TRUE`, or you must be logged in as a superuser.
+
+* If `AUTO_LOGIN` is `FALSE`, you must be logged in as a superuser.
+* If `AUTO LOGIN` is `TRUE`, you're already logged in as superuser.
+
+For more information, see [API keys](/configuration-api-keys).

 ```bash
 langflow api-key [OPTIONS]
 # or
-python -m langflow api-key [OPTIONS]
+uv run langflow api-key [OPTIONS]
 ```

 #### Options
--- a/docs/docs/Configuration/environment-variables.md
+++ b/docs/docs/Configuration/environment-variables.md
@ -179,7 +179,7 @@ The following table lists the environment variables supported by Langflow.
 | Variable | Format | Default | Description |
 |----------|--------|---------|-------------|
 | <Link id="DO_NOT_TRACK"/>DO_NOT_TRACK | Boolean | `false` | If this option is enabled, Langflow does not track telemetry. |
-| <Link id="LANGFLOW_AUTO_LOGIN"/><span class="env-prefix">LANGFLOW_</span>AUTO_LOGIN | Boolean | `true` | Enable automatic login for Langflow. Set to `false` to disable automatic login and require the login form to log into the Langflow UI. Setting to `false` requires [`LANGFLOW_SUPERUSER`](#LANGFLOW_SUPERUSER) and [`LANGFLOW_SUPERUSER_PASSWORD`](environment-variables.md#LANGFLOW_SUPERUSER_PASSWORD) to be set. |
+| <Link id="LANGFLOW_AUTO_LOGIN"/><span class="env-prefix">LANGFLOW_</span>AUTO_LOGIN | Boolean | `true` | Enable automatic login for Langflow. Set to `false` to disable automatic login and require the login form to log into the Langflow UI. Setting to `false` requires [`LANGFLOW_SUPERUSER`](#LANGFLOW_SUPERUSER) and [`LANGFLOW_SUPERUSER_PASSWORD`](environment-variables.md#LANGFLOW_SUPERUSER_PASSWORD) to be set. For more information, see [Authentication](/configuration-authentication). |
 | <Link id="LANGFLOW_AUTO_SAVING"/><span class="env-prefix">LANGFLOW_</span>AUTO_SAVING | Boolean | `true` | Enable flow auto-saving.<br/>See [`--auto-saving` option](./configuration-cli.md#run-auto-saving). |
 | <Link id="LANGFLOW_AUTO_SAVING_INTERVAL"/><span class="env-prefix">LANGFLOW_</span>AUTO_SAVING_INTERVAL | Integer | `1000` | Set the interval for flow auto-saving in milliseconds.<br/>See [`--auto-saving-interval` option](./configuration-cli.md#run-auto-saving-interval). |
 | <Link id="LANGFLOW_BACKEND_ONLY"/><span class="env-prefix">LANGFLOW_</span>BACKEND_ONLY | Boolean | `false` | Only run Langflow's backend server (no frontend).<br/>See [`--backend-only` option](./configuration-cli.md#run-backend-only). |
@ -233,6 +233,7 @@ The following table lists the environment variables supported by Langflow.
 | <Link id="LANGFLOW_WORKERS"/><span class="env-prefix">LANGFLOW_</span>WORKERS | Integer | `1` | Number of worker processes.<br/>See [`--workers` option](./configuration-cli.md#run-workers). |
 | <Link id="LANGFLOW_SSL_CERT_FILE"/><span class="env-prefix">LANGFLOW_</span>SSL_CERT_FILE | String | Not set | Path to the SSL certificate file on the local system. |
 | <Link id="LANGFLOW_SSL_KEY_FILE"/><span class="env-prefix">LANGFLOW_</span>SSL_KEY_FILE | String | Not set | Path to the SSL key file on the local system. |
+| <Link id="SKIP_AUTH_AUTO_LOGIN"/>SKIP_AUTH_AUTO_LOGIN | Boolean | `false` | If set to `true`, disables automatic login and enforces authentication, regardless of the value of `LANGFLOW_AUTO_LOGIN`.
 </div>


--- a/docs/docs/Deployment/deployment-public-server.md
+++ b/docs/docs/Deployment/deployment-public-server.md
@ -69,9 +69,9 @@ For example:

 ```bash
 curl -X POST \
-  "$PUBLIC_SERVER_DOMAIN/api/v1/webhook/$FLOW_ID" \
+  "PUBLIC_SERVER_DOMAIN/api/v1/webhook/FLOW_ID" \
  -H "Content-Type: application/json" \
-  -H "x-api-key: $LANGFLOW_API_KEY" \
+  -H "x-api-key: LANGFLOW_API_KEY" \
  -d '{"data": "example-data"}'
 ```

@ -97,7 +97,7 @@ For example, the following code snippet calls an ngrok domain to trigger the spe
    # Request headers
    headers = {
        "Content-Type": "application/json",
-        "x-api-key: $LANGFLOW_API_KEY"
+        "x-api-key: LANGFLOW_API_KEY"
    }

    try:
--- a/docs/docs/Develop/session-id.md
+++ b/docs/docs/Develop/session-id.md
@ -16,11 +16,12 @@ This differentiation between users per session is helpful in managing client/ser
 Custom session IDs can be set as part of the payload in API calls, or as advanced settings in individual components. The API session ID value takes precedence. If no session ID is specified, the flow ID is assigned.

 If you set a custom session ID in a payload, all downstream components use the upstream component's session ID value.
-
+Replace `LANGFLOW_SERVER_ADDRESS`, `FLOW_ID`, and `LANGFLOW_API_KEY` with the values from your Langflow deployment.
 ```
 curl --request POST \
-  --url 'http://localhost:7860/api/v1/run/$FLOW_ID' \
-  --header 'Content-Type: application/json' \
+  --url "http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID" \
+  --header "Content-Type: application/json" \
+  --header "x-api-key: $LANGFLOW_API_KEY" \
  --data '{
  "input_value": "Hello",
  "output_type": "chat",
--- a/docs/docs/Develop/webhook.md
+++ b/docs/docs/Develop/webhook.md
@ -63,8 +63,9 @@ To use the **Webhook** component in a flow, do the following:
    The following example sends a payload containing `id`, `name`, and `email` strings:

    ```bash
-    curl -X POST "$LANGFLOW_SERVER_URL/api/v1/webhook/$FLOW_ID" \
-        -H 'Content-Type: application/json' \
+    curl -X POST "http://localhost:7860/api/v1/webhook/FLOW_ID" \
+        -H "Content-Type: application/json" \
+        -H "x-api-key: LANGFLOW_API_KEY" \
        -d '{"id": "12345", "name": "alex", "email": "alex@email.com"}'
    ```

--- a/docs/docs/Get-Started/get-started-quickstart.md
+++ b/docs/docs/Get-Started/get-started-quickstart.md
@ -13,6 +13,35 @@ Get started with Langflow by loading a template flow, running it, and then servi

 - [A running Langflow instance](/get-started-installation)
 - [An OpenAI API key](https://platform.openai.com/api-keys)
+- [A Langflow API key](/configuration-api-keys)
+
+## Create a Langflow API key
+
+A [Langflow API key](/configuration-api-keys) is a user-specific token you can use with Langflow.
+
+To create a Langflow API key, do the following:
+
+1. In Langflow, click your user icon, and then select **Settings**.
+2. Click **Langflow API Keys**, and then click <Icon name="Plus" aria-hidden="true"/> **Add New**.
+3. Name your key, and then click **Create API Key**.
+4. Copy the API key and store it in a secure location.
+5. Include your `LANGFLOW_API_KEY` in requests like this:
+    ```text
+    curl --request POST \
+     --url 'http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID' \
+     --header 'Content-Type: application/json' \
+     --header 'x-api-key: LANGFLOW_API_KEY' \
+     --data '{
+       "output_type": "chat",
+       "input_type": "chat",
+       "input_value": "Hello"
+     }'
+    ```
+    The API access pane's code snippets include a script that looks for a `LANGFLOW_API_KEY` environment variable set in your terminal session.
+    Set this variable in your terminal so you can copy and paste the commands.
+    ```bash
+    export LANGFLOW_API_KEY="sk..."
+    ```

 ## Run the Simple Agent template flow

@ -67,9 +96,9 @@ Langflow provides code snippets to help you get started with the Langflow API.
 1. To open the **API access pane**, in the **Playground**, click **Share**, and then click **API access**.

    The default code in the API access pane constructs a request with the Langflow server `url`, `headers`, and a `payload` of request data.
-    The code snippets automatically include the `LANGFLOW_SERVER_ADDRESS` and `FLOW_ID` values for the flow.
+    The code snippets automatically include the `LANGFLOW_SERVER_ADDRESS` and `FLOW_ID` values for the flow, and a script to include your `LANGFLOW_API_KEY` if you've set it as an environment variable in your terminal session.
    Replace these values if you're using the code for a different server or flow.
-    The default Langflow server address is `http://localhost:7860`
+    The default Langflow server address is `http://localhost:7860`.

    <Tabs groupId="Language">
      <TabItem value="Python" label="Python" default>
@ -88,7 +117,8 @@ Langflow provides code snippets to help you get started with the Langflow API.

    # Request headers
    headers = {
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        "x-api-key": "$LANGFLOW_API_KEY"
    }

    try:
@ -119,7 +149,8 @@ Langflow provides code snippets to help you get started with the Langflow API.
    const options = {
        method: 'POST',
        headers: {
-            'Content-Type': 'application/json'
+            'Content-Type': 'application/json',
+            'x-api-key': 'LANGFLOW_API_KEY'
        },
        body: JSON.stringify(payload)
    };
@ -138,6 +169,7 @@ Langflow provides code snippets to help you get started with the Langflow API.
    curl --request POST \
         --url 'http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID?stream=false' \
         --header 'Content-Type: application/json' \
+         --header "x-api-key: LANGFLOW_API_KEY" \
         --data '{
          "output_type": "chat",
          "input_type": "chat",
@ -353,7 +385,10 @@ This script runs a question-and-answer chat in your terminal and stores the Agen
            "input_value": question,
        }

-        headers = {"Content-Type": "application/json"}
+        headers = {
+        "Content-Type": "application/json",
+        "x-api-key": "LANGFLOW_API_KEY"
+        }

        try:
            response = requests.post(url, json=payload, headers=headers)
@ -426,7 +461,8 @@ This script runs a question-and-answer chat in your terminal and stores the Agen
        const options = {
            method: 'POST',
            headers: {
-                'Content-Type': 'application/json'
+                'Content-Type': 'application/json',
+                'x-api-key': 'LANGFLOW_API_KEY'
            },
            body: JSON.stringify(payload)
        };