Tenancy and credentials

The single account that owns every app your builders build, and the credential your server calls Base44 with.

One Base44 account sits behind your whole integration. It owns every app your builders create, and its personal access token authenticates every call you make, which also makes keeping your builders apart your job rather than Base44’s.

Integration roles

Four parties are involved in every white label integration, and here’s how we refer to each one throughout the docs:

Role	What it does
Base44	Provides the harness that runs the app build behind your API calls.
Your platform	Owns sign-in, tenancy, billing, and everything your users see.
A builder	One of your platform’s users, who describes an app and answers the questions the agent asks while it builds.
An end user (optional)	Someone who uses the published app, without participating in a build.

Who owns the apps

Your integration authenticates as a single Base44 account holding a personal access token. Every app your builders create belongs to that one account, and no Base44 identity exists for the builder at all.

Every call to Base44 goes through your own backend, and no credential is ever sent to the browser.

Authenticating as the integration account

Your server sends that account’s personal access token as Authorization: Bearer <token> on every Apps API call.

A personal access token belongs to the workspace it was created in, and only reaches that workspace. The account also has its own personal workspace, separate from your enterprise workspace, the one holding your design system, skills, and plan. Create the token in your enterprise workspace, not the account’s personal workspace, or your builds miss the design system, skills, and plan you set up. Give the token access to All apps and Superagents and Full access permission, since your integration creates, edits, and publishes apps.

Name the workspace explicitly on every API call too. Send X-Active-Workspace-Id: <workspace id>, and set workspace_id or organization_id where an endpoint takes one.

Personal access tokens replace account API keys, and from October 15, 2026 you can no longer use an account API key. If your integration still sends api_key: <key>, replace that header with Authorization: Bearer <token>. See moving from account API keys.

Keeping your builders apart is yours to enforce.

Base44 sees a single identity behind every build, so it has no way to tell your builders apart on its own. Scoping each builder to their own data, and hiding other builders’ apps, is entirely up to you. Build those checks into your own backend, and test them the way you’d test any other security boundary.

Permissions

The account your integration authenticates as needs an editor-capable role, Editor or above, in your workspace. Viewers and guests can’t create apps, and Deploy an app only succeeds for an Editor.

See also

• Setup checklist: Everything you need to do to get an integration running
• Design system: Put your brand on everything your builders build
• Apps API reference: Every endpoint this page builds on, including authentication