Gating an endpoint by a key's role

An API key can carry an optional, free form role, set when you create it on the Keys & Secrets tab (or added later by rotating the key). It's just a text label, "admin", "guest", whatever your project needs, there's no fixed list, you decide what each one means in your own endpoint's logic.

Building an admin only endpoint

1. Create the API key you'll hand to trusted callers, giving it the role admin.
2. In the endpoint's graph, right after the Trigger, add a Condition block with field apiKeyRole, operator Equals, value admin.
3. Wire the "False" connection to an Error Response block, status 403, body something like {"error": "Admins only."}.
4. Wire the "True" connection into the rest of your endpoint's real logic.

A request with no API key, or a key whose role was left blank, evaluates apiKeyRole as an empty string, so it takes the "False" branch and gets rejected, exactly like any other value that isn't admin. Turn on Requires an API key in the endpoint's settings as well, otherwise a caller could still reach it with no key at all before your Condition block ever runs.