Dataset holds what your flows use but shouldn't carry in their graph: accounts, AI keys, credentials, variables and data tables. Flows refer to them by id; secrets only travel in the run payload and never back to the page.
| Page | Path | Holds |
|---|---|---|
| Accounts | /app/<workspace>/dataset/account | 𝕏, Threads, Facebook and Shopee sign-ins, 2FA, proxy, engine |
| AI keys | /app/<workspace>/dataset/ai | OpenAI / DeepSeek keys, model, effort, prices |
| Credentials | /app/<workspace>/dataset/credential | Logins and API keys nodes sign requests with (header, bearer, basic, OAuth2, Google, Telegram, Slack, SMTP…) |
| Posts | /app/<workspace>/dataset/post | Ready-made posts (text, photos, videos) auto post flows hand out one at a time, written, imported from a Drive folder or generated with AI |
| Knowledge | /app/<workspace>/dataset/knowledge | Documents your flows search by meaning (RAG): chunks embedded with an OpenAI key, kept in mooflair, Qdrant or Pinecone |
| Variables | /app/<workspace>/dataset/variable | Values read as {{ vars.name }} |
| Tables | /app/<workspace>/dataset/table | Rows your flows read and write |
Who can use it
Every account, AI key, credential and variable has Who can use it: everyone in the workspace (default), admins and me, only me, or people I pick. Creators, owners and admins can always use it; Studio only lists what you may use, and runs check it again (see Security). Secrets are encrypted at rest and never shown.
Export and import
Every Dataset page has ⋯ beside its Add button: Export dataset or Import dataset. A dialog lists your accounts, AI keys, credentials, post sets, variables and tables, grouped; tick what to bring. A post set comes with its posts (their media as Drive references).
| Switch | Off (default for secrets) | On |
|---|---|---|
| Include passwords and keys | Accounts, AI keys, credentials and secret variables come without their secrets (fill them after import) | 𝕏 passwords and 2FA secrets, proxy passwords, AI keys, credential values and secret variable values are in the file: keep it private (OAuth2 tokens never are: connect again) |
| Include table rows | Only the table and its columns | Its rows too |
The file is mooflair-dataset.json:
{
"mooflair": "dataset",
"isSecret": false,
"account": [{ "platform": "X", "x": { "username": "CARLOSSIFONTES8" }, "browser": { "proxy": null } }],
"ai": [{ "name": "DeepSeek", "provider": "deepseek", "model": "deepseek-chat" }],
"variable": [{ "name": "brand", "value": "Turu Bed", "isSecret": false }],
"table": [{ "name": "leads", "column": [{ "name": "url", "kind": "text" }], "row": [] }]
}
Import skips an entry you already have (same account username, same AI key, variable or table name) and an entry that needs a secret the file doesn't carry, and tells you which.
Browser sign-ins don't travel. A browser profile (cookies, the 𝕏 or Shopee session) belongs to a campaign and stays on its engine; after importing, a campaign signs the account in again on its first run.
FAQ
Can other members see my passwords?
No. Secrets never reach a page, and they're encrypted in the database. Members can only use an account in their flows when its Who can use it allows them.
Are my passwords visible to the Studio page?
No. Credentials are stored on the server and never sent back to the browser. When a run starts, the fields a node needs are put into what the run gets for the engine.
What happens to a flow when I remove an account it uses?
The node's account field points at nothing; the run refuses to start with <node>: account not found until you pick another.
Does an account have a browser?
No. An account is data (credentials, a proxy). The browsers, with their Chrome profiles (cookies and sessions), belong to a campaign (or a flow, in tests) and are kept between runs.
How does mooflair know a sign-in worked?
The sign-in node checks the page (𝕏: your home timeline shows; Shopee Affiliate: its search box shows) and goes on.