REST API and Auth

Where we left off

Beginner reached for the REST API twice already, Lesson 7 to resolve a Global Variable, Lesson 8 to demonstrate memory, both times as a necessary workaround for something run_flow_from_json genuinely can't do. This lesson covers the REST API properly: what else it can do, and the auth header underneath every call you've already made.

Do this yourself

1. Open My Flows in the sidebar, this is the same list GET /api/v1/flows/ returns, just rendered as cards instead of JSON.
2. Open your browser's dev tools (Network tab), click into any flow, run it once in the Playground. Find the POST /api/v1/run/{id} call in the network log, this is the exact request run_flow() in lesson.py makes, just issued by the browser instead of httpx.
3. Notice the request has no visible x-api-key header, the browser session authenticates a different way (a cookie from your login). lesson.py's calls aren't a browser session, so they authenticate with the LANGFLOW_API_KEY header explicitly, that's the difference this lesson is about.

The code, piece by piece

HEADERS = {"x-api-key": os.environ["LANGFLOW_API_KEY"]}

Every call in this lesson sends this same header. Drop it, and the server rejects the request before it even looks at which flow you're asking for, lesson.py's first call does exactly this on purpose to show the rejection.

def list_flows() -> list[dict]:
    response = httpx.get(f"{LANGFLOW_URL}/api/v1/flows/", headers=HEADERS)

GET /api/v1/flows/, every flow currently stored on the server, upload_flow()'s POST /api/v1/flows/upload/ from Lesson 7 is how a flow gets added to this list in the first place.

def delete_flow(flow_id: str) -> None:
    response = httpx.delete(f"{LANGFLOW_URL}/api/v1/flows/{flow_id}", headers=HEADERS)

DELETE /api/v1/flows/{flow_id}, the opposite of upload, removes it from the server entirely. This lesson cleans up after itself, uploading a flow just to run and delete it, so repeated runs of lesson.py don't leave a pile of identical test flows behind on your server.