Security

Floogos includes a role-based access management and control system to protect your flows and integrations.

User profiles

Role	Description
Super Administrator	Has full access to all resources
Workflow Manager	Can create, edit, and execute flows
Credential Manager	Can manage keys, tokens, and access to external services
Support	Accesses logs and can intervene in error cases

Credential management

Credentials are the encrypted storage system for API keys, tokens, passwords, and database connections. They are stored in the servicecredentials table as encrypted JSON.

Supported credential types

Type	Usage example	Typical fields
API Key	OpenAI, Telegram	apiKey
Basic Auth	HTTP, REST APIs	username, password
OAuth2/Token	Shopify, Google	accessToken, refreshToken
Database	PostgreSQL, MySQL, MSSQL, Oracle	host, port, user, password, database
SMTP	Email	host, port, user, password, secure
Webhook URL	Slack	webhookUrl
Bot Token	Telegram	botToken
E-commerce	Shopify, WooCommerce	shopDomain, accessToken, apiVersion

Using credentials in modules

Each node that requires authentication uses the credentials_id field, which references securely stored credentials. Never write credentials directly in configuration fields.

{
  "credentials_id": 5,
  "operation": "getProducts"
}

Credential security

• Encryption: Credentials are stored encrypted in the database
• Isolation: Each client_id only accesses its own credentials
• No exposure in logs: Credentials never appear in traces or execution logs
• Rotation: Update credentials periodically without needing to modify workflows

Lock resources with a key

You can protect a workflow, form, dashboard or webhook so nobody can modify or delete it without a key, while it can still be viewed and run. The administrator or the resource owner sets it. More details in Lock a resource with a key.

Security recommendations

• Use one user per team with the minimum necessary permissions
• Keep production and test credentials separate
• Review permissions before sharing access
• Never hardcode credentials in node text fields
• Always validate data received via webhooks before processing it
• Apply the principle of least privilege for external API credentials
• Rotate credentials periodically
• Lock with a key the workflows and webhooks that already work in production to avoid accidental changes.