Sophia Flow

Settings

JWT / OIDC Authentication

The OIDC provider base URL. The flow engine fetches {issuer}/.well-known/openid-configuration to discover the JWKS endpoint. Tokens must carry a matching iss claim.

Expected aud claim — usually the OAuth2 client ID. Leave blank to skip audience validation.

Admin API key

Set the FLOW_API_KEY environment variable to enable a pre-shared admin bypass key. Pass it as X-Api-Key: <key> or Authorization: Bearer <key>. The admin key always works regardless of JWT settings — use it for initial setup and automation.