Docs
Kiwi Flow
Version Current

Configuration reference

Administration and access control

Users, roles and groups, API keys, the audit log, resource guards and licensing.

Flow Current 2 min read Updated

Prerequisites

  • Admin access to Kiwi Flow

First-time setup#

kiwi flow setup creates the first admin (with a required email address) and prints an initial API key. It fails if any user already exists. See the quickstart.

Users, roles and groups#

Every account has a mandatory email address. Access is granted through roles and groups.

bash
kiwi flow user-add --user bob --password "<initial-password>" --email bob@example.com
kiwi flow role-add --name workflow-author
kiwi flow perm-add  --role <role-id> --operation "*" --resource "workflow:*" --effect ALLOW
kiwi flow group-add --name finance
kiwi flow user-role-assign --user bob --role <role-id>

Use kiwi flow roles, groups, role-perms and user-roles to inspect what is granted. The same functions are in Studio under the admin area (users, roles, groups, audit).

API keys#

Account API keys give programmatic access and back the client SDKs and the CLI:

bash
kiwi flow key-add --user bob --name "ci-pipeline" --expires 2027-01-01

The raw key is shown once. Revoke with key-revoke.

Audit log#

Every administrative and execution event is recorded. Filter by user, operation, resource type and time:

bash
kiwi flow audit --resource-type workflow --from 2026-10-01T00:00:00Z --limit 50

Resource guards#

Guards bound what a run may consume. An administrator (superadmin) sets them, and they apply live, except the REST rate limit which is read at start-up:

bash
kiwi flow resource-guards-get
kiwi flow resource-guards-set --timeout 600 --max-output-bytes 5000000 --max-concurrent-runs 20 --rate-limit 600
Option Meaning
--timeout Run timeout in seconds
--max-output-bytes Maximum output bytes per activity before the run is rejected
--max-concurrent-runs Maximum concurrently executing runs
--rate-limit REST requests per minute (restart required)

The numbers are examples only; size them for your workloads.

Licensing#

Platform access and optional capabilities are controlled by a licence, activated with an activation key (kiwi flow license-activate --activation-key <key>) or from the /activate page in the web application. A licence can gate:

  • coarse online platform access;
  • AI generation (generate and enhance);
  • per-integration connector entitlements such as the Kiwi Fabric and Kiwi Distro connectors;
  • usage limits: number of workflows and runs per day.

Check the state with kiwi flow license-status and the server version with kiwi flow system-info.