docs(relayflows): lead FLOWS_CLOUD_TOKEN with the dashboard, not CLI login

Merged
KH
1mo ago
+8-10

Why

AgentWorkforce/cloud#3549 (merged) added a self-serve 'Relayflows Cloud token' purpose to the dashboard's Workspace API tokens card, mirroring how deployment tokens and Relayfile agent keys are already provisioned there. This doc previously only documented agent-relay cloud login, a CLI-only flow — that predates #3549.

What

Rewrites the FLOWS_CLOUD_TOKEN acquisition section in cloud.mdx to lead with the dashboard:

  1. Cloud dashboard → Settings → Workspace API tokens → Purpose: Relayflows Cloud token.
  2. Copy the one-time cld_at_... value, export as FLOWS_CLOUD_TOKEN.

That mints a token scoped to exactly workflow:invoke:read, workflow:invoke:write, workflow:runs:read, workflow:logs:read — no CLI, no special access.

agent-relay cloud login stays documented as an alternative for headless/SSH hosts with no browser, but is no longer the only/primary path. Dropped the old paragraph about the operator-only mint-ci-token DB-access script, since the dashboard purpose now covers that exact same narrow scope self-serve.

Verification

$ npx tsc --noEmit   # exit 0
$ npm run build      # exit 0

Made with Cursor

Summary by cubic

Rewrites the FLOWS_CLOUD_TOKEN docs to lead with the dashboard's Workspace API tokens page instead of the agent-relay CLI login, matching the new self-serve token purpose from AgentWorkforce/cloud#3549.

  • The dashboard token carries only workflow:invoke:read, workflow:invoke:write, workflow:runs:read, and workflow:logs:read.
  • agent-relay cloud login stays documented as an alternative for headless hosts, but its token uses a broader cli:auth scope.
  • Drops the operator-only mint-ci-token database-access script since the dashboard now covers that scope self-serve.
  • Makes the token placeholder in the export command explicit so it isn't mistaken for a copy-pasteable literal.