API key authentication

Create and use

Open Applications, select an application and create a key in Credentials → API Keys with permitted scopes. Store the plaintext shown once in secure backend configuration, outside Git, logs and client code.

The canonical header is X-API-Key. Do not treat a key as a user OAuth token. Calls require endpoint support for keys plus matching identity and scopes. This example illustrates credential transport; use an endpoint your key is authorized to call:

curl --fail-with-body "${APPFORGES_API_BASE_URL}/v1/users/me" \
  -H "X-API-Key: ${APPFORGES_API_KEY}" \
  -H "X-AppForges-Api-Version: 2026-04-01"

The profile endpoint requires User identity and user:profile:read; an organization/service key does not invent user identity. For first user integration use OAuth.

Expiry, scopes and subject depend on actual key configuration; keys are not guaranteed to last forever. See API key management for rotation and revocation.