> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Internal links on these pages omit the .md extension. Append .md to a docs page URL, or send an Accept: text/markdown header, to get that page as markdown.

# Tenancy and credentials

> The single account that owns every app your builders build, and the credential your server calls Base44 with.

One Base44 account sits behind your whole integration. It owns every app your builders create, and its personal access token authenticates every call you make, which also makes keeping your builders apart your job rather than Base44's.

## Integration roles

Four parties are involved in every white label integration, and here's how we refer to each one throughout the docs:

| Role | What it does |
| :- | :- |
| Base44 | Provides the harness that runs the app build behind your API calls. |
| Your platform | Owns sign-in, tenancy, billing, and everything your users see. |
| A builder | One of your platform's users, who describes an app and answers the questions the agent asks while it builds. |
| An end user (optional) | Someone who uses the published app, without participating in a build. |

## Who owns the apps

Your integration authenticates as a single Base44 account holding a personal access token. Every app your builders create belongs to that one account, and no Base44 identity exists for the builder at all.

Every call to Base44 goes through your own backend, and no credential is ever sent to the browser.

## Authenticating as the integration account

Your server sends that account's [personal access token](/Workspaces/Personal-access-tokens) as `Authorization: Bearer <token>` on every [Apps API](/developers/references/apps-api/get-started/overview) call.

A personal access token belongs to the workspace it was created in, and only reaches that workspace. The account also has its own personal workspace, separate from your enterprise workspace, the one holding your design system, skills, and plan. Create the token in your enterprise workspace, not the account's personal workspace, or your builds miss the design system, skills, and plan you set up. Give the token access to **All apps and Superagents** and **Full access** permission, since your integration creates, edits, and publishes apps.

Name the workspace explicitly on every API call too. Send `X-Active-Workspace-Id: <workspace id>`, and set `workspace_id` or `organization_id` where an endpoint takes one.

<Note>
  Personal access tokens replace account API keys, and from **October 15, 2026** you can no longer use an account API key. If your integration still sends `api_key: <key>`, replace that header with `Authorization: Bearer <token>`. See [moving from account API keys](/Workspaces/Personal-access-tokens#moving-from-account-api-keys).
</Note>

<Warning>
  **Keeping your builders apart is yours to enforce.**

  Base44 sees a single identity behind every build, so it has no way to tell your builders apart on its own. Scoping each builder to their own data, and hiding other builders' apps, is entirely up to you. Build those checks into your own backend, and test them the way you'd test any other security boundary.
</Warning>

## Permissions

The account your integration authenticates as needs an editor-capable role, Editor or above, in your workspace. Viewers and guests can't create apps, and [Deploy an app](/api-reference/deploy-an-app) only succeeds for an Editor.

## See also

* [Setup checklist](/developers/white-label/setup-checklist): Everything you need to do to get an integration running
* [Design system](/developers/white-label/design-system): Put your brand on everything your builders build
* [Apps API reference](/developers/references/apps-api/get-started/overview): Every endpoint this page builds on, including authentication


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.