fix: preserve api key configuration on flow export

Made-with: Cursor

Author: HimavarshaVS

src/backend/base/langflow/api/utils/__init__.py

@@ -36,6 +36,7 @@
     parse_value,
     raise_error_if_astra_cloud_env,
     remove_api_keys,
+    replace_api_key_with_env_var_name,
     validate_is_component,
     verify_public_flow_and_get_user,
 )
@@ -75,6 +76,7 @@
     "parse_value",
     "raise_error_if_astra_cloud_env",
     "remove_api_keys",
+    "replace_api_key_with_env_var_name",
     "validate_is_component",
     "verify_public_flow_and_get_user",
 ]

src/backend/base/langflow/api/utils/core.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 import uuid
 from ast import literal_eval
 from datetime import timedelta
@@ -68,14 +69,61 @@ def has_api_terms(word: str):
     return "api" in word and ("key" in word or ("token" in word and "tokens" not in word))
 
 
+def _get_provider_from_template(template: dict) -> str | None:
+    """Return provider name from template's model field, if any."""
+    model_field = template.get("model")
+    if not isinstance(model_field, dict):
+        return None
+    raw = model_field.get("value")
+    if isinstance(raw, list) and len(raw) > 0 and isinstance(raw[0], dict):
+        return raw[0].get("provider")
+    return None
+
+
+def _looks_like_variable_name(value: Any) -> bool:
+    """Return True if value looks like a variable name."""
+    if not value or not isinstance(value, str) or not value.strip():
+        return False
+    return bool(re.fullmatch(r"[A-Za-z][A-Za-z0-9_]*", value.strip()))
+
+
+def replace_api_key_with_env_var_name(flow: dict) -> dict:
+    """Normalize api_key to a variable name when possible, never export raw keys."""
+    for node in flow.get("data", {}).get("nodes", []):
+        node_data = node.get("data")
+        if not isinstance(node_data, dict):
+            continue
+        node_inner = node_data.get("node")
+        if not isinstance(node_inner, dict):
+            continue
+        template = node_inner.get("template")
+        if not isinstance(template, dict):
+            continue
+        for value in template.values():
+            if (
+                isinstance(value, dict)
+                and value.get("name") == "api_key"
+                and value.get("password")
+            ):
+                current = value.get("value")
+                if _looks_like_variable_name(current):
+                    break  # keep user's custom variable name
+                # raw secret or other string: clear it
+                value["value"] = None
+                break
+    return flow
+
+
 def remove_api_keys(flow: dict):
-    """Remove api keys from flow data."""
+    """Clear secret values from flow data."""
+    flow = replace_api_key_with_env_var_name(flow)
     for node in flow.get("data", {}).get("nodes", []):
         node_data = node.get("data").get("node")
         template = node_data.get("template")
         for value in template.values():
             if isinstance(value, dict) and "name" in value and has_api_terms(value["name"]) and value.get("password"):
-                value["value"] = None
+                if value.get("name") != "api_key":
+                    value["value"] = None
 
     return flow
 

src/backend/base/langflow/api/v1/flows.py

@@ -21,7 +21,14 @@
 from sqlmodel import and_, col, select
 from sqlmodel.ext.asyncio.session import AsyncSession
 
-from langflow.api.utils import CurrentActiveUser, DbSession, cascade_delete_flow, remove_api_keys, validate_is_component
+from langflow.api.utils import (
+    CurrentActiveUser,
+    DbSession,
+    cascade_delete_flow,
+    remove_api_keys,
+    replace_api_key_with_env_var_name,
+    validate_is_component,
+)
 from langflow.api.v1.schemas import FlowListCreate
 from langflow.helpers.user import get_user_by_flow_id_or_endpoint_name
 from langflow.initial_setup.constants import STARTER_FOLDER_NAME
@@ -480,6 +487,8 @@ async def update_flow(
         if flow.endpoint_name is None or flow.endpoint_name == "":
             update_data["endpoint_name"] = None
 
+        # Never persist raw api_key; use env var name so import resolves from env
+        update_data = replace_api_key_with_env_var_name(update_data)
         if settings_service.settings.remove_api_keys:
             update_data = remove_api_keys(update_data)
 
@@ -672,6 +681,8 @@ async def _update_existing_flow(
     if "folder_id" not in update_data or update_data.get("folder_id") is None:
         update_data.pop("folder_id", None)
 
+    # Never persist raw api_key; use env var name so import resolves from env
+    update_data = replace_api_key_with_env_var_name(update_data)
     if settings_service.settings.remove_api_keys:
         update_data = remove_api_keys(update_data)
 

src/frontend/src/modals/exportModal/index.tsx

@@ -13,7 +13,11 @@ import {
 } from "../../constants/constants";
 import useAlertStore from "../../stores/alertStore";
 import { useDarkStore } from "../../stores/darkStore";
-import { downloadFlow, removeApiKeys } from "../../utils/reactflowUtils";
+import {
+  downloadFlow,
+  removeApiKeys,
+  replaceApiKeyWithEnvVarName,
+} from "../../utils/reactflowUtils";
 import BaseModal from "../baseModal";
 
 const ExportModal = forwardRef(
@@ -57,7 +61,9 @@ const ExportModal = forwardRef(
         setOpen={setOpen}
         onSubmit={async () => {
           try {
-            const flowToExport: FlowType = {
+            // TODO: Full-version export (embedding all versions) is planned as a follow-up feature.
+            // For now, export only the current working version of the flow.
+            let flowToExport: FlowType = {
               id: currentFlow!.id,
               data: currentFlow!.data!,
               description,
@@ -69,6 +75,9 @@ const ExportModal = forwardRef(
               locked,
             };
 
+            // Never export raw api_key; always use env var name so import resolves from env
+            flowToExport = replaceApiKeyWithEnvVarName(flowToExport);
+
             if (checked) {
               await downloadFlow(flowToExport, name!, description);
 

src/frontend/src/utils/reactflowUtils.ts

@@ -437,16 +437,36 @@ export function isValidConnection(
   return false;
 }
 
+function looksLikeVariableName(value: unknown): boolean {
+  if (typeof value !== "string" || !value.trim()) return false;
+  return /^[A-Z][A-Z0-9_]*$/i.test(value.trim());
+}
+
+export function replaceApiKeyWithEnvVarName(flow: FlowType): FlowType {
+  const out = cloneDeep(flow);
+  out.data!.nodes.forEach((node) => {
+    if (node.type !== "genericNode") return;
+    const template = node.data.node!.template;
+    if (!template.api_key) return;
+    const current = template.api_key.value;
+    if (looksLikeVariableName(current)) return;
+    template.api_key.value = "";
+  });
+  return out;
+}
+
 export function removeApiKeys(flow: FlowType): FlowType {
-  const cleanFLow = cloneDeep(flow);
-  cleanFLow.data!.nodes.forEach((node) => {
+  const cleanFlow = replaceApiKeyWithEnvVarName(cloneDeep(flow));
+  cleanFlow.data!.nodes.forEach((node) => {
     if (node.type !== "genericNode") return;
-    for (const key in node.data.node!.template) {
-      const field = node.data.node!.template[key];
+    const template = node.data.node!.template;
+    for (const key in template) {
+      const field = template[key];
 
-      // Remove password fields
       if (field.password) {
-        field.value = "";
+        if (key !== "api_key") {
+          field.value = "";
+        }
       }
 
       // Handle MCP server configurations
@@ -455,12 +475,11 @@ export function removeApiKeys(flow: FlowType): FlowType {
         field.value &&
         typeof field.value === "object"
       ) {
-        // Type assertion is safe here as we've verified it's an object with runtime checks
         cleanMcpConfig(field.value as MCPServerValue);
       }
     }
   });
-  return cleanFLow;
+  return cleanFlow;
 }
 
 export function updateTemplate(

src/lfx/src/lfx/base/models/__init__.py

@@ -26,6 +26,7 @@
     "LIVE_MODEL_PROVIDERS",
     "LCModelComponent",
     "apply_provider_variable_config_to_build_config",
+    "get_api_key_variable_key_for_provider",
     "fetch_live_ollama_models",
     "fetch_live_watsonx_models",
     "get_live_models_for_provider",

src/lfx/src/lfx/base/models/unified_models.py

@@ -2,6 +2,7 @@
 
 import importlib
 import os
+import re
 from functools import lru_cache
 from typing import TYPE_CHECKING, Any
 from uuid import UUID
@@ -382,17 +383,56 @@ def get_unified_models_detailed(
 def get_api_key_for_provider(user_id: UUID | str | None, provider: str, api_key: str | None = None) -> str | None:
     """Get API key from self.api_key or global variables.
 
+    When api_key is set to an environment variable name (e.g. ANTHROPIC_API_KEY),
+    that name is resolved from os.environ or global variables so imported flows
+    can reference credentials without storing the raw key.
+
     Args:
         user_id: The user ID to look up global variables for
         provider: The provider name (e.g., "OpenAI", "Anthropic")
-        api_key: An optional API key provided directly
+        api_key: An optional API key provided directly, or an env var name to resolve
 
     Returns:
         The API key if found, None otherwise
     """
-    # First check if user provided an API key directly
-    if api_key:
-        return api_key
+    # Resolve variable name (canonical or custom e.g. MY_OPENAI_API_KEY) from env or global vars
+    def _resolve_var_name(var_name: str) -> str | None:
+        env_value = os.environ.get(var_name)
+        if env_value and env_value.strip():
+            return env_value.strip()
+        if user_id and not (isinstance(user_id, str) and user_id == "None"):
+            async def _get_by_var_name():
+                async with session_scope() as session:
+                    variable_service = get_variable_service()
+                    if variable_service is None:
+                        return None
+                    try:
+                        return await variable_service.get_variable(
+                            user_id=UUID(user_id) if isinstance(user_id, str) else user_id,
+                            name=var_name,
+                            field="",
+                            session=session,
+                        )
+                    except ValueError:
+                        return None
+
+            value = run_until_complete(_get_by_var_name())
+            if value and str(value).strip():
+                return str(value).strip()
+        return None
+
+    if api_key and api_key.strip():
+        var_name = api_key.strip()
+        # Names that look like env/global variables (e.g. MY_OPENAI_API_KEY): resolve from env/DB
+        if var_name.replace("_", "").isalnum() and var_name[0].isalpha():
+            resolved = _resolve_var_name(var_name)
+            if resolved:
+                return resolved
+            # Unresolved variable name: don't use as literal key
+            if re.match(r"^[A-Z][A-Z0-9_]*$", var_name):
+                return None
+        # Literal API key (e.g. sk-...)
+        return var_name
 
     # If no user_id or user_id is the string "None", we can't look up global variables
     if user_id is None or (isinstance(user_id, str) and user_id == "None"):