API keys

An API key lets your own code call the Auto Appy API as you, without signing in. Keys start with aa_key_.

In the course

• SRA Daily pipeline report key for a reporting script. Lesson 6: Plug in the website and a daily report →

Create a key

1. Go to Settings → API keys and click Create API key.

   Open API keysautoappy.com/settings/api-keys

2. Fill in:

   • Key name: what it’s for, such as Website contact sync. One key per integration makes revoking easy.
   • Access: Read only (viewing and listing) or Read and write (create, update, delete and run).
   • Expiration: Never expires, or after 30 days, 90 days or one year.

3. Click Generate key.

4. Copy the key now. This is the only time the full key is shown. Store it in a password manager or your server’s environment variables, then click I’ve saved my key.

autoappy.com/settings/api-keysSample data

×

Your keys are listed with their name, the first characters of the key, access level, when they were created and last used, and when they expire.

autoappy.com/settings/api-keysSample data

×

Use a key

Send it as a Bearer token:

Authorization: Bearer aa_key_…
Accept: application/json

curl

curl "https://api.autoappy.com/workflows" \
  -H "Authorization: Bearer $AUTOAPPY_API_KEY" \
  -H "Accept: application/json"

JavaScript

const res = await fetch('https://api.autoappy.com/workflows', {
  headers: { Authorization: `Bearer ${process.env.AUTOAPPY_API_KEY}`, Accept: 'application/json' },
});
const { workflows } = await res.json();
console.log(workflows.map((w) => `${w.name} (${w.status})`));

Python

import os, requests

res = requests.get(
    "https://api.autoappy.com/workflows",
    headers={"Authorization": f"Bearer {os.environ['AUTOAPPY_API_KEY']}", "Accept": "application/json"},
)
for w in res.json()["workflows"]:
    print(w["name"], w["status"])

Organisation requests

A key acts as you, with your existing permissions. For requests about an organisation’s data, also send the organisation’s central ID:

X-AutoAppy-Workspace: 9f1c2e7a-4b5d-4c3e-8a21-5d6f7e8a9b0c

Read only or read and write?

Access	Can	Use for
Read only	Supported viewing and listing operations.	Dashboards, reports, syncing data out.
Read and write	Everything your account can do through the API: create, update, delete, run.	Integrations that change things or run workflows.

Note

Some read endpoints, such as a workflow’s run history, currently need a Read and write key. If a read-only key gets a 403 on a read, try a read-and-write key.

What keys can’t do

Keys can’t manage keys, sign in, change passwords or profile settings, use admin features, or connect to the MCP server (assistants use their own MCP connections). Webhook URLs don’t use keys at all.

Limits

• 120 requests per minute per key. Above that you get 429; wait and retry.
• Up to 50 active keys per person per product.
• Each Auto Appy product has its own keys: an Auto Appy key doesn’t work in WhatsApp or CRM, and the other way round.

Rotate or revoke

To revoke, click Revoke on the key and confirm. It stops working immediately. To rotate, create a new key, switch your code to it, check it works, then revoke the old one.

If a key leaks

Revoke it straight away, then create a new one. Never put keys in web pages, mobile apps, screenshots or public code: anyone with a key can act as you.

REST API

What is an API?