An agent is an AI worker that completes a single task end-to-end. You give it a task description, optionally upload supporting documents, and choose which platform-tool actions, AI models, and workflows it may invoke. The agent then runs a loop — calling the AI model, picking a tool, getting a result, deciding the next step — until it produces a final answer.

The four types

Interactive — comes with a public chat URL and an embeddable chat widget for your website. End-users send messages; the agent replies turn-by-turn. You can give it a friendly slug (so visitors land on /a/my-agent instead of a random token), choose between public access and password-protection, and embed the same widget on a separate domain. Branding (logo, colors) is configurable; if your plan allows, you can also hide the "Powered by Flowfn" footer.
Webhook — triggered by an HTTP POST to a per-agent webhook URL. Useful for inbound events from other systems (a form submission, a Stripe event, a cron from another platform). You can pick the upstream platform (Stripe, GitHub, Slack, etc.) so the engine verifies that platform's signature header natively, or use a generic webhook with an optional X-Flowfn-Signature HMAC header.
Schedule — triggered on a cron schedule. Use for periodic tasks (daily summaries, hourly check-ins).
Playground — bound to a playground. When an end-user submits playground inputs, the agent runs.

Common configuration

Task. A single sentence (or paragraph) describing what the agent should accomplish. The runtime keeps iterating until it produces a final answer for this task.
Support files. PDFs, HTML, plain text, Markdown, JSON, or CSV files the agent can refer to for context. Total size and per-file size are subject to your plan.
Calibration. After uploading support files you click Calibrate. The AI prepares a summary of the documents focused on your task; you review, edit if needed, and approve. The runtime always has the option to reach back into the raw files when the summary lacks detail. Calibration also reflects your allowed tools and how each input is sourced; change the agent's tools or triggers afterwards and a dismissible Recalibrate banner reminds you to refresh the brief so it stays in sync.
AI model. By default the agent uses your account's AI preferences. You can override per-agent (force a specific provider + model, set the max tokens per message, and pick a specific team AI connection). When using the platform AI key, optionally name a backup team connection so the run survives platform-key quota / rate-limit errors.
Max tokens per message. Three layers: (1) the per-agent Max tokens per message input on the agent edit page is the explicit override; (2) a default on each team AI connection (Team Settings → AI) or on your personal API key (My Account → AI assistant) applies when the agent has no override; (3) the model's registry default is the final fallback. All three are clamped at runtime by per-source plan caps (system / team / custom AI). A stale agent doc saved before the plan tightened still runs correctly — the cap is enforced on every LLM call.
Allowed tools. Pick which platform-tool actions, AI tools, and MCP servers the agent may invoke. Each binding carries a team connection (or, for AI tools, an optional connection — the platform AI key is used when allowed by your plan). Without an explicit allow-listing, the agent cannot call a tool. For each action and AI model you can add an optional "When should the agent use this?" note — it's passed to the agent in its tool list so it reaches for the right tool at the right moment instead of guessing (the same guidance workflow triggers already carry). For each action you can also set optional input defaults: pin a fixed Custom value for an input, or Describe to AI how to find it (free text, e.g. "use the email from the customer's latest message"). Leave an input unset and the agent decides — an interactive agent asks the visitor for it. A pinned value always wins over the agent's own choice, and secured inputs only accept a description, never a stored value. Interactive (public chat) agents have an extra guardrail: high-impact actions (delete, refund, mass-broadcast, send SMS, role assignments, e-signature send, Gmail send) and entire high-impact platforms (Stripe, AWS, accounting, HR, raw databases) are filtered out of the picker to defuse prompt injection. Other agent types keep full access. See Platform Tools for the action-availability breakdown.
Workflows to trigger. List workflows the agent may trigger and describe when each should fire. The AI decides at runtime — could be at the start, in the middle, or at the end of the task. The workflow's trigger inputs take the same optional input defaults (a fixed Custom value or a Describe-to-AI instruction).
Approval rules. Add a rule, describe the situation, and choose what the agent should do when it applies. Pause for approval stops the run and asks you to approve before continuing — reject to stop, approve to resume (you can require more than one approver). Or Ask the team for information: when the agent is unsure of something it can't work out on its own (which account or warehouse to use, a value it needs), it pauses and asks your team in plain language, and the run continues the moment anyone replies — there's no approve/reject, just the information it needs. For either mode you can pick who's notified and let them respond straight from the email without signing in.
Saved clarifications. When someone answers an "ask the team" request they can tick save this for future runs, and the answer is kept on the agent so it doesn't have to ask again. You can review, edit, or seed these notes by hand on the agent's edit page. They're treated as reference information for the agent (never as instructions) and added to every run.

Public access & embedding (interactive agents)

Public URL. Every interactive agent has a public chat URL at /a/<identifier>. The identifier can be the random embed token (always works), or a custom slug you set on the edit page (e.g. /a/support-bot).
Public vs password-protected. By default the agent is public: anyone with the URL can chat. Flip the Public access toggle off and set a password and visitors hit a password gate before the chat surface renders — same UX as a protected form. Passwords are encrypted at rest with the agent's envelope-encryption key and can be rotated or cleared at any time. Setting a password automatically marks the agent private.
Embedding on another site. The Embed controls let you drop the agent's widget into your own website via a script tag or iframe. Add the domains that may host the widget in Allowed domains — requests from other origins are rejected at the engine. Embedding is independent from public access: a password-protected agent embedded on your site still asks visitors for the password before they can chat.
Owner takeover. On a run's detail page you can switch from the steps timeline to a conversation view and reply as the agent. Your reply lands in the conversation without invoking the LLM (no tokens, no credits), and the next time the end-user replies the model sees your turn in history.
Branding — logo + launcher icon. The Embed & branding tab takes two separate images: a logo shown in the header inside the open chat surface, and an optional launcher icon shown on the floating launcher button on the host site. Pair a tiny monochrome launcher with a full-colour header logo, or upload only the logo and the launcher falls back to a built-in speech-bubble emoji. Colours (primary / accent / surface / text) and a public-facing display name are configured on the same tab. Hiding the "Powered by Flowfn" footer is plan-gated.
Search visibility (SEO). Off by default. On a plan that includes SEO, open the Publish tab's Search visibility section and turn on Enable SEO so search engines may index the agent's public chat page; optionally set an SEO title, description, and keywords (blank fields fall back to the public display name and description from Branding). Indexing needs the agent to be active, public, on a custom slug, and served on your app's own subdomain or custom domain — token URLs and flowfn.com/a/<…> always stay out of search.

Skills

A skill is a named block of operating instructions you attach to an agent on the Skills tab — for example "How to triage a support email" or "Refund policy". Each enabled skill is added to the agent's instructions at run time, so the agent follows it when relevant. Skills are guidance, not tools — they don't grant the agent any new permissions or actions.

Three ways to create one. Write it by hand; upload a text file (Markdown, plain text, JSON, CSV, or HTML) whose contents become the skill body; or generate one with AI — describe what you want and the assistant drafts a skill from the agent's task and knowledge brief for you to review and edit. AI generation uses your AI credits, the same as other AI assistance.
Enable / disable. Toggle a skill off to set it aside without deleting it — only enabled skills reach the agent.
Reviewed like the rest of the agent. Skill text is screened by content moderation on save and is included in your data export, just like the agent's task and knowledge brief.
The number of skills per agent is plan-limited.

Testing an agent

Every agent has a Test tab. For an interactive agent it's a chat panel — message the agent as a developer. For webhook, schedule, and playground agents it's a Run test button: supply a sample input (the JSON body a webhook would post, or a sample trigger payload — scheduled agents take none) and trigger a run, then open the resulting run to inspect each step.

A test run is a real run. It executes with your live configuration — it can send real emails, write real data, trigger real workflows, and pause for real approvals — and it uses your credits and counts toward your daily run limit, exactly like a production trigger. Test runs appear under Runs and can be retried like any other run.

Real-world example: a support-triage agent

Create an Interactive agent with the task "Answer the customer's question from our docs; if it's a billing dispute, escalate."
Upload your help-centre articles as support files and Calibrate so the agent has a focused brief.
Allow a "create support ticket" tool, and add an approval rule: "If the customer asks for a refund, pause for approval."
Give it a slug (/a/support) and embed the chat widget on your site.

Visitors get instant doc-grounded answers; refunds wait for a human; every conversation is visible under Runs.

Plan limits

Plans cap the maximum number of agents, runs per day, concurrent runs, support files and file size, skills per agent, run history retention, MCP connections and MCP calls per day. Hiding the "Powered by Flowfn" widget footer is also plan-gated. Free plans typically allow a small number of agents and exclude the hide-logo branding control.

Agents overview