Help & documentation

01Core concepts

Flowroid automations are called flows. A flow is three parts that run in sequence.

1. Starts on

   Triggers

   A device event starts the flow — a notification arrives, you reach a location, the battery drops. A flow can have one or more.

2. Guarded by

   Conditions

   Optional checks evaluated when a trigger fires. The flow only continues if they pass. An empty group passes.

3. Then runs

   Actions

   What the flow does, in order. Each action can read the output of the ones before it. Every run is logged to history.

Flows are event-driven — they react to events rather than polling — and fail gracefully: if one action errors, the flow logs it and either continues, retries, or stops based on your settings, but never crashes the app.

02Getting started

Install & first launch

1. Install Flowroid from Google Play and open it.
2. On first launch you're guided through the Permissions overview, where you grant only the permissions the features you want require.
3. Flowroid starts a persistent foreground service that keeps your automations alive. The small ongoing notification shows how many flows are active — that's what lets flows run when the app isn't open.

Create your first flow

The fastest start is the Templates library: ready-made automations you install in one tap and customise. To build from scratch:

1. Tap + New Flow.
2. Add a trigger (for example, Battery State).
3. Optionally add conditions.
4. Add one or more actions (for example, Post Notification).
5. Give the flow a name, enable it, and save.

Your flow is now live and runs whenever its trigger fires.

03Building flows

The visual editor

Flows are built in a visual editor where you assemble triggers, conditions, and an ordered chain of actions. Each trigger and action presents a form generated from its configuration schema, so you only ever see the options that are relevant.

Action chaining & outputs

Actions run sequentially. Every action produces structured outputs that later actions can reference using template expressions. For example, an HTTP Request action exposes statusCode, headers, body, and latency, which a following action reads with {{previous.http.body}}.

Control flow

First-class control-flow actions let a flow branch, loop, and call sub-flows:

• If / Else — run one set of nested actions or another based on a condition group.
• Loop — repeat nested actions forEach item, a fixed number of times, or while a condition holds (with a maxIterations safety cap).
• Call Sub-Flow — invoke another flow and pass it an input object, enabling reusable building blocks.
• Delay, Stop, Log, plus Math, String, and Array helpers for in-flow data manipulation.

Error handling

Each action can be configured to continue, stop, or retry on error. Failures are recorded in the flow's execution history with logs, so you can see exactly what happened and when.

04Trigger catalog

Flowroid ships 30 triggers. Permissions noted are only required if you use that trigger.

05Action catalog

Flowroid ships 45+ actions. Each action's outputs are available to later actions via template expressions.

06Conditions

Conditions let a flow decide whether to proceed, or which branch to take in an If / Else. Each condition compares a left value (usually a template expression) against a right value using an operator.

Operators

Combining conditions

Conditions group into AND / OR sets, and groups can nest arbitrarily deep for complex logic. An empty condition group passes (evaluates to true).

AND
├── {{event.sender}} EQUALS "+15551234567"
└── OR
    ├── {{event.body}} CONTAINS "urgent"
    └── {{event.body}} CONTAINS "important"

07Variables & template expressions

Scopes

Template expressions

Anywhere a field accepts dynamic input, use {{ ... }} expressions with dot-notation and array indexing:

{{event.sender}}              Trigger event field
{{event.data.nested}}         Nested field
{{event.items[0]}}            Array index
{{global.counter}}            Global variable
{{flow.temp}}                 Flow-scoped variable
{{previous.http.body}}        Output of a previous action (by type)
{{prev[0].output.field}}      Output of a previous action (by index)
{{device.battery.level}}      Live device state
{{secret.api_key}}            Secret value (read-only)

Device variables

The device.* namespace exposes live state without needing a trigger:

• Battery — device.battery.level, .charging, .status
• Network — device.network.connected, .type, .wifi
• Screen — device.screen.brightness
• Android — device.android.version, .release
• Locale — device.locale.language, .country
• Time — device.time.zone, .timestamp

Referencing a category without a property (e.g. {{device.battery}}) returns the whole object as JSON.

Secrets Pro

Secret variables are encrypted at rest using AES-256-GCM with a key held in the device's hardware-backed Keystore (where available). Secret values are masked everywhere in the UI, are never written to logs, and are read-only inside expressions — a flow can use {{secret.api_key}} but cannot overwrite it. The secret vault is a Pro feature.

08Permissions

Flowroid only asks for the permissions needed by the features you actually use. They fall into two groups: standard runtime permissions (granted with a system dialog) and special-access permissions (granted on a dedicated Android settings screen).

Runtime permissions

Special-access permissions

These are granted through Android's settings, not a popup. Flowroid links you straight to the right screen. The Permissions screen shows everything at a glance, grouped by category, with grant status and one-tap actions; a Guided mode walks you through only the permissions that still need attention.

09Keeping automations running

Android aggressively stops background apps to save battery, and some manufacturers are far more aggressive than others. To make sure your flows run when you expect them to:

1. Exempt Flowroid from battery optimization. The single most important step. Settings → Apps → Flowroid → Battery → Unrestricted / Not optimized.
2. Enable auto-start on Xiaomi, Oppo / Realme, Vivo / iQOO, OnePlus, Huawei / Honor, Asus, and similar. These brands block apps from starting after a reboot unless you allow auto-start in their own settings. Flowroid provides a shortcut to the relevant manufacturer screen.
3. Grant notification access if you use notification triggers.
4. Grant exact-alarm access if you use schedules and want minute-accurate timing.

Boot behaviour

When your device restarts, Flowroid's boot receiver restarts the foreground service (if auto-start is enabled) and resumes all enabled flows. Boot triggers fire after you first unlock the device, once encrypted storage becomes available — Flowroid does not run during the locked, pre-unlock phase.

10Templates

Flowroid ships 46 ready-made templates spanning beginner to intermediate automations. Install one in a tap, customise its values (times, locations, app choices, thresholds), and it becomes a normal editable flow. A sampling of what's included:

• Silent at Night

  Go silent at bedtime on selected days.

• Low Battery Alert

  Notify when the battery drops below a threshold.

• Wi-Fi at Home

  Manage Wi-Fi on geofence arrival.

• Flip to Silence

  Silence the phone when placed face-down.

• Headphones Auto-Play

  Launch music and set volume when headphones connect.

• NFC Office Mode

  Tap a tag to switch to work mode.

• Auto Dark Mode at Sunset

  Schedule-based dark mode.

• Pocket Mode Protection

  Lock the screen when pocketed.

• Meeting Auto-Silence

  Silence during calendar events.

• Battery Overheat Warning

  Alert on high battery temperature.

• Auto TTS Notification Reader

  Read notifications aloud.

• Media Pause on Call

  Pause media on an incoming call, resume after.

• File Backup on Charge

  Back up a file when charging.

…and many more across power, connectivity, sensors, and productivity.

11Import & export

Every flow can be exported to a portable file and re-imported on the same or another device — handy for backups, sharing, or moving between devices. Import / export works entirely with local device storage: no account or cloud required. (Flows can also be exported and imported through the API server.)

12The embedded HTTP API server

Flowroid can run an embedded HTTP server directly on your device, turning your phone into an automation endpoint that external systems call. The device is the server — your computer, home-automation hub, or another phone connects to the phone. This is a Pro feature.

Security model

The API server is off by default and built secure-by-default:

• Localhost-only by default. It binds to 127.0.0.1 and is unreachable from the network until you explicitly enable the Enable LAN access toggle (which rebinds to 0.0.0.0 and shows a clear warning).
• Authentication required. All protected routes require an API key or a JWT bearer token. The signing secret is stored in the hardware-backed Keystore; if that's unavailable the server refuses to start rather than fall back to a guessable secret.
• Scoped access. API keys carry fine-grained scopes (flows:read, flows:write, flows:execute, variables:read, webhooks:write) so you grant only what each integration needs.
• CORS closed by default. No browser origins are allowed unless you add them to an allow-list; wildcard origins are rejected.
• Request body cap of 1 MiB and configurable rate limiting.
• Secrets never leave in plaintext. Secret variables are returned masked; revealing a value requires a separate dedicated scope.
• SSRF protection on outbound HTTP actions (loopback, link-local, and private ranges are blocked by default).
• Optional HTTPS / TLS with a self-signed certificate you can export, and HMAC-SHA256 signature verification for inbound webhooks.

Authentication flow

Exchange an API key for a short-lived JWT, or authenticate per-request with the key directly (X-Api-Key: fd_live_xxxx).

# Exchange an API key for a short-lived JWT
curl -X POST http://<device-ip>:8080/api/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"apiKey":"fd_live_xxxxxxxxxxxxxxxx"}'
# → { "accessToken": "...", "refreshToken": "...", "expiresIn": 900 }

Core endpoints

All endpoints are versioned under /api/v1.

Run a flow remotely

curl -X POST http://<device-ip>:8080/api/v1/flows/<flow-id>/execute \
  -H "X-Api-Key: fd_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{"input":{"reason":"manual run"},"sync":true}'

Inbound webhooks

Create a webhook bound to a flow, then trigger it from any external system. The webhook can require no auth, an API key, a bearer token, or an HMAC-SHA256 signature:

BODY='{"event":"deploy","status":"green"}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "your-secret" -hex | sed 's/^.* //')
curl -X POST http://<device-ip>:8080/api/v1/hooks/my-webhook \
  -H "Content-Type: application/json" \
  -H "X-Signature: sha256=$SIG" \
  -d "$BODY"

Live, interactive reference

The server publishes its own always-current OpenAPI spec and Swagger UI on the device: GET /openapi.json and /openapi.yaml for the machine-readable spec, GET /docs for interactive Swagger UI, and GET /redoc for the ReDoc viewer. Because these are generated from the running server, they are the authoritative, version-matched reference for your specific build.

13Plans & pricing

Flowroid has two tiers. Pricing is shown in the app and on Google Play, localised to your region.

14Privacy & security

• On-device by default. Core automation runs entirely on your phone. No account requirement and no cloud relay for normal flow execution.
• Sensitive data stays local. Notification titles and text are never written to Flowroid's logs. Secret variables are encrypted at rest with a hardware-backed key and masked throughout the UI.
• The API server is opt-in, localhost-bound, and authenticated. Network exposure requires an explicit toggle; all protected routes require scoped credentials; CORS is closed by default.
• Outbound requests are guarded. The HTTP action blocks server-side request forgery against loopback, link-local, and private address ranges by default.
• No restricted permissions. Flowroid does not request SMS, call-log, or accessibility-service permissions.
• Honest capability disclosures. Where Android or a manufacturer restricts a capability, the relevant template or action says so plainly in-app.

The full Privacy Policy details exactly what each permission accesses and where the data goes.

15Troubleshooting & FAQ

Still stuck? Reach the maker directly — Flowroid has no telemetry, so the detail you include is all support has to go on.

Back to top