Authentication
Send your organization API key as a bearer token.
Every API key endpoint needs this header:
Authorization: Bearer <api-key>Keys in the query string are not accepted. A missing or wrong key returns 401.
Webhooks are the exception: they take no key. See Webhooks.
Get the key
In the app, open Settings > API key. Only organization admins can see, copy and rotate the key.
What the key can read
The key belongs to your organization, not to a person. It reads every workspace and table in the organization, private workspaces included. Workspace sharing settings do not apply to it, so changing who can see a workspace never breaks an integration.
Treat the key like an admin password.
Keep it on your server
Store the key in an environment variable and call Baseloop from your backend. Never put it in browser code, a mobile app or a public repository. For a website or dashboard, call Baseloop from a server route and send your page only the data it needs.
The Try it panel in these docs sends the key from your browser and forgets it when you leave or reload the page.
Rotate the key
In Settings > API key, click Rotate, then Rotate key to confirm. The old key stops working right away and the new one is copied to your clipboard, so update your integrations straight after.
What the key does not open
The key works only with the endpoints in these docs. The CLI signs in with your own account instead; see CLI.