How Does Flow Market Protect Workflow Credentials and API Keys?

How Does Flow Market Protect Workflow Credentials and API Keys? The platform does not execute workflows and tells creators to strip secrets before upload. Rule checks look for obvious credential dumps. You must still rotate any key that ever sat in a file you published.

How it works

Buyers replace credentials after import. Community bans public key dumps.

Steps

• Export a sanitized workflow.
• Search the JSON for tokens before upload.
• Rotate anything that leaked.
• Read the credentials guide.

Watch for

Flow Market cannot scrub a key that already hit GitHub or a screenshot.

Last updated 4 November 2026.