docs: configurable api key validation

docs/docs/Develop/api-keys-and-authentication.mdx

@@ -27,6 +27,9 @@ You can use Langflow API keys to interact with Langflow programmatically.
 
 By default, most Langflow API endpoints, such as `/v1/run/$FLOW_ID`, require authentication with a Langflow API key.
 
+Langflow validates API keys against keys stored in the database, but you can configure Langflow to validate API keys against an environment variable instead.
+For more information, see [`LANGFLOW_API_KEY_SOURCE`](#langflow-api-key-source).
+
 To require API key authentication for flow webhook endpoints, use the [`LANGFLOW_WEBHOOK_AUTH_ENABLE`](/webhook#require-authentication-for-webhooks) environment variable.
 To configure authentication for Langflow MCP servers, see [Use Langflow as an MCP server](/mcp-server).
 
@@ -284,6 +287,122 @@ LANGFLOW_NEW_USER_IS_ACTIVE=False
 Only superusers can manage user accounts for a Langflow server, but user management only matters if your server has authentication enabled.
 For more information, see [Start a Langflow server with authentication enabled](#start-a-langflow-server-with-authentication-enabled).
 
+### LANGFLOW_API_KEY_SOURCE {#langflow-api-key-source}
+
+This variable controls how Langflow validates API keys.
+
+| Value | Description |
+|-------|-------------|
+| `db` (default) | Validates API keys against [Langflow API keys](#langflow-api-keys) stored in the database. This is the standard behavior where users create and manage API keys through the Langflow UI or CLI. |
+| `env` | Validates API keys against the `LANGFLOW_API_KEY` environment variable. Useful for Kubernetes deployments, CI/CD pipelines, or any environment where you want to inject a pre-defined API key without database configuration. |
+
+By default, Langflow validates the `x-api-key` header against the Langflow database with `LANGFLOW_API_KEY_SOURCE=db`.
+When using database-based validation, you can create multiple keys with per-user permissions, track usage, and manage keys through the Langflow UI or CLI.
+
+When `LANGFLOW_API_KEY_SOURCE=env`, Langflow validates the `x-api-key` header against the value of the `LANGFLOW_API_KEY` environment variable.
+This means Langflow runs securely in stateless environments, such as with LFX or Kubernetes secrets.
+
+When `LANGFLOW_API_KEY_SOURCE=env`, only a single API key can be used for the deployment. All authenticated requests use the same API key, and successful authentication grants superuser privileges.
+This mode is designed for single-tenant deployments or automated systems, not multi-user environments where different users need different access levels. To rotate your keys, update the environment variable and restart the Langflow server.
+
+To enable environment-based API key validation:
+
+1. In the Langflow `.env` file, set the API key source to `env`:
+
+    ```text
+    LANGFLOW_API_KEY_SOURCE=env
+    ```
+
+2. In the Langflow `.env` file, set the API key value:
+
+    ```text
+    LANGFLOW_API_KEY=your-secure-api-key
+    ```
+
+3. Use the API key in your requests:
+
+    ```shell
+    curl -X POST \
+      "http://LANGFLOW_SERVER_ADDRESS/api/v1/run/FLOW_ID?stream=false" \
+      -H "Content-Type: application/json" \
+      -H "x-api-key: LANGFLOW_API_KEY" \
+      -d '{"inputs": {"text":""}, "tweaks": {}}'
+    ```
+
+    Replace `LANGFLOW_SERVER_ADDRESS`, `FLOW_ID`, and `LANGFLOW_API_KEY` with the values from your deployment.
+
+<details>
+<summary>Kubernetes deployment example</summary>
+
+To configure an environment-based API key in a Kubernetes Secret, do the following:
+
+1. Create a Kubernetes Secret with your API key:
+
+    ```yaml
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: langflow-api-key
+    type: Opaque
+    stringData:
+      api-key: "YOUR_API_KEY"
+    ```
+
+    Replace `YOUR_API_KEY` with the `LANGFLOW_API_KEY` value from the Langflow `.env` file.
+
+2. Reference the `langflow-api-key` Secret in your Kubernetes deployment:
+
+    ```yaml
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: langflow
+    spec:
+      template:
+        spec:
+          containers:
+          - name: langflow
+            image: langflowai/langflow:latest
+            env:
+            - name: LANGFLOW_API_KEY_SOURCE
+              value: "env"
+            - name: LANGFLOW_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: langflow-api-key
+                  key: api-key
+    ```
+
+</details>
+
+<details>
+<summary>Docker Compose example</summary>
+
+To configure an environment-based API key in Docker Compose, do the following:
+
+1. Set the API key in your Langflow `.env` file.
+
+    ```text
+    LANGFLOW_API_KEY=your-secure-api-key
+    ```
+
+    Replace `YOUR_API_KEY` with your actual Langflow API key value.
+
+2. Create or update your `docker-compose.yml` file to set `LANGFLOW_API_KEY_SOURCE=env` and reference the `LANGFLOW_API_KEY`.
+
+    ```yaml
+    services:
+      langflow:
+        image: langflowai/langflow:latest
+        environment:
+          - LANGFLOW_API_KEY_SOURCE=env
+          - LANGFLOW_API_KEY=${LANGFLOW_API_KEY}
+        ports:
+          - "7860:7860"
+    ```
+
+</details>
+
 ### LANGFLOW_CORS_* {#cors-configuration-for-authentication}
 
 Cross-Origin Resource Sharing (CORS) configuration controls how authentication credentials are handled when your Langflow frontend and backend are served from different origins.
@@ -365,7 +484,7 @@ Additionally, you must sign in as a superuser to manage users and [create a Lang
 
     If you don't set a secret key, Langflow generates one automatically, but this isn't recommended for production environments.
 
-    For instructions on generating at setting a secret key, see [`LANGFLOW_SECRET_KEY`](#langflow-secret-key).
+    For instructions on generating and setting a secret key, see [`LANGFLOW_SECRET_KEY`](#langflow-secret-key).
 
 4. Save your `.env` file with the populated variables. For example:
 

docs/docs/Support/release-notes.mdx

@@ -64,6 +64,10 @@ For all changes, see the [Changelog](https://github.com/langflow-ai/langflow/rel
 
     Added the `LANGFLOW_WEBHOOK_AUTH_ENABLE` environment variable for authenticating requests to the [`/webhook` endpoint](/api-flows-run#webhook-run-flow). When `LANGFLOW_WEBHOOK_AUTH_ENABLE=TRUE`, webhook endpoints require API key authentication and validate that the authenticated user owns the flow being executed. When `FALSE`, no Langflow API key is required and all requests to the webhook endpoint are treated as being sent by the flow owner. For more information, see [Trigger flows with webhooks](/webhook).
 
+- Configurable API key validation
+
+    Added the `LANGFLOW_API_KEY_SOURCE` environment variable to control how Langflow validates API keys. When set to `db`, Langflow validates API keys against keys stored in the database. When set to `env`, Langflow validates API keys against the `LANGFLOW_API_KEY` environment variable. For more information, see [API keys and authentication](/api-keys-and-authentication#langflow-api-key-source).
+
 - SSRF protection
 
     Added SSRF (Server-Side Request Forgery) protection to the [**API Request** component](/api-request). HTTP redirects are disabled by default to prevent SSRF bypass attacks. To enable SSRF protection, set `LANGFLOW_SSRF_PROTECTION_ENABLED=TRUE`. Configure allowed hosts with `LANGFLOW_SSRF_ALLOWED_HOSTS`. Flows that relied on automatic redirects will need to enable it manually.