Is a CI key different from a production key?

Keys are minted per account, and the dashboard lets you label them. Teams typically mint a separate key for CI so it can be revoked independently without touching production traffic.

Will the log show which workflow made a call?

The log records the key, the target, the method, the status and the timing, and forwards any custom header you send — so pass a run identifier header if you want to join a call to a specific workflow run.

GitHub Actions

Call APIs from CI without handing out long-lived secrets

CI jobs end up holding credentials for every service they touch. A relay key gives a workflow one outbound capability that can be revoked the moment a run misbehaves — and a log of exactly what it called.

What to expect

Store the key as a repository or organisation secret; nothing else to configure.
Every job in a workflow shares the same request shape, so scripts stay short.
Timeouts are clamped, which keeps a hanging upstream from stalling a runner.
The activity log distinguishes a CI backfill from production traffic.

Working example

github-actions

- name: Sync upstream data
  env:
    BACKFIRE_KEY: ${{ secrets.BACKFIRE_KEY }}
  run: |
    curl -sS https://backfireapi.base44.app/functions/forward \
      -H "Authorization: Bearer $BACKFIRE_KEY" \
      -H "Content-Type: application/json" \
      -d '{"url":"https://api.example.com/v1/sync","method":"POST","body":{"full":true},"timeout_ms":20000}' \
      -o sync.json
    jq -e '.ok and .upstream.status < 400' sync.json

Other environments

Vercel Cloudflare Workers AWS Lambda GitHub Actions Supabase Edge Functions n8n

Questions about this

Keep reading

n8n Use cases Documentation

Try it with 5,000 free trips.

No card, no subscription, and the balance never expires.

Create an account Read the docs