Skip to main content
Workspace secrets let you create and manage API keys for programmatic access to your workspace. Use these keys to stream audit logs, pull workspace data through the Monitoring API, read or manage users over SCIM, or deploy apps. Each key carries only the permissions you give it. Keys are workspace-owned, so they stay active even if the member who created them leaves the workspace.
Important:
  • Workspace secrets are available on the Business plan and above. Requiring your workspace’s apps to use workspace keys instead of personal API keys is an Enterprise control.
  • Only workspace owners and admins can view and manage secrets.
Manage credentials and access tokens for your workspace.

Manage credentials and access tokens for your workspace.

For a full list of supported APIs, see the API reference.

​
Creating an API key

You can create up to 10 API keys per workspace.
Important:
  • Copy your key immediately after creating it. You will not be able to see it again.
  • Treat it like a password: it grants access to your workspace data via the API.
To create an API key:
  1. Click your workspace name at the bottom left and click Settings.
  2. Click Secrets in the sidebar.
  3. Click + Create API Key.
  4. Enter a name for the key (required) and an optional description.
  5. Under Permissions, select the scopes this key should have. See Choosing permissions for what each one grants.
  6. If you select Deploy apps, set its App access to Selected apps and choose the apps, or to All current and future apps.
  7. Click Create Key.
  8. Copy the key and store it somewhere safe.
  9. Click Done.
Creating an API key for your workspace

Creating an API key for your workspace

​
Choosing permissions

Each API key has one or more permissions, called scopes, that control which parts of your workspace it can access. Give a key only the permissions the integration needs. For the Deploy apps permission, choose which apps the key can reach:
  • Selected apps: The key can only deploy the specific apps you choose.
  • All current and future apps: The key can deploy any app in the workspace, including apps you add later.
You can make changes to a key at any time. To update its name, description, or permissions, edit the key from the Secrets page.

​
Managing your API keys

From the Secrets page, you can view all your keys along with who created them, when they were created, and when they were last used. Click the More Actions icon next to a key to edit, disable, or delete it.
Creating, editing, enabling, disabling, and deleting a key are all recorded in your workspace audit logs, and actions taken with a key are attributed to it.
To manage an API key:
  1. Click your workspace name at the bottom left and click Settings.
  2. Click Secrets in the sidebar.
  3. Click the More Actions icon next to the key you want to manage and select an option:
    • Edit: Update the key’s name, description, or permissions.
    • Disable key: Temporarily prevent the key from being used without deleting it.
    • Enable key: Re-enable a previously disabled key.
    • Delete key: Permanently remove the key.
Managing your workspace API keys

Managing your workspace API keys

​
Blocking personal account API keys

Alongside the workspace keys you create here, every Base44 user has their own personal account API key. While someone is a member of your workspace, their personal key can reach your workspace’s apps and data. You can block personal keys so that only workspace API keys, which admins create and manage, can be used. You can do this whether or not your workspace uses SSO. It is especially useful if you require SSO for all workspace members, because it closes the gap between how people sign in and how they can reach your data programmatically.
Blocking personal account API keys requires the Enterprise plan.
Before you turn this on:
  • The setting shows how many requests used a personal account API key against your workspace in the last 30 days, and how many members are actively using their keys, so you can see who this affects. You can review the full list in your audit logs.
  • Workspace API keys are not affected, so anything built on an admin-managed key keeps working.
  • App users signing in to your published apps are not affected.
To block personal account API keys:
  1. Click your workspace name at the bottom left of your account.
  2. Click Settings.
  3. Click Authentication.
  4. Turn on Block account API keys.
The Block account API keys setting on the Authentication page

Blocking personal account API keys for your workspace