API keys

Your API key identifies your app. Send it in the Authorization header of each request:

Authorization: Bearer YOUR_API_KEY

Getting a key

In the dashboard, open your app, then API keys → New API key. Give the key a name and copy it. It’s shown only once.

Store it in your server’s configuration. Keep it out of frontend code and your repository. You don’t need to send an app ID alongside it.

Apps, teams and keys

An app is the service your users connect to. Its name appears when they approve access to a site. Your team can have several apps, each with its own keys and approvals. A user’s user_ref is the same for every app of your team; it only works with your team’s keys.

Your AI assistant doesn’t use your team’s apps: it acts through a private app of your own account, which only reaches your own browsers.

Replacing a key

Create a new key, update your server to use it, then revoke the old one in the dashboard. Revoked keys stop working immediately.

Keys don’t expire and belong to the app. A key keeps working if the teammate who created it leaves.

Account access

Your account

Sign up with your email: the account is ready at once, with your own team. There’s no password. You sign in with a 6-digit code sent by email, valid for one hour, or with a link in the same email. You stay signed in for 30 days after your last visit.

The users of your app have Apigami accounts too, created the same way when they first connect.

Confirming your email

Creating your first app and using the MCP server require a confirmed email address. The dashboard asks you to confirm it and sends the confirmation email. Signing in with a code confirms it too.

To add a teammate, invite them by email from Team. The invitation email carries a link that works for their address only, for 14 days; accepting it confirms their address.

If no member of the app’s team has an active account, API requests return 403 client disabled. A disabled account cannot sign in.

Connected users

A user must connect their account to your app before you can call it. Knowing a user_ref alone doesn’t give access.

Private apps are for team members. Unlisted apps let anyone with the link connect.

Verification

An unverified app can connect up to ten users. Contact us when you’re ready to connect more. Your dashboard shows Verified after the review.

Verification limits and compatibility

The eleventh user sees client not verified on the connect page; the ten existing connections keep working. A team without a verified app can publish up to three apps beyond private ones. The approval window identifies apps that haven’t been verified yet.

Older integrations may send appId or clientId in the request body. If present, it must match the key’s app, or the request returns 400 clientId does not match the token. The word client is kept in error strings for compatibility.

For a missing or revoked key, the API returns 401 bad client credentials. See Troubleshooting for help with other responses.