Authentication: API keys

The API uses workspace API keys, which start with xsk_. Each key has a name, works only in the workspace where it was created and only for the scopes you check.

Create the keyCopy Anchor Link

1. In XBASE, open Integrations and go to the Agents & APIs tab. You need permission to manage integrations.
2. On the API keys card, click New key (or Connect integration, if it is your first one).
3. In Name, write who will use the key, like "Store ERP".
4. In Permissions, check only what the integration needs (scopes).
5. Click Create key. The Key created window shows the full key only once: copy it and keep it in a password manager.
6. Click Done, I've copied it.

Use the keyCopy Anchor Link

Send the key in the Authorization header. To check that it works, call GET /me:

curl https://api.xbase.app/api/external/v1/me \
  -H "Authorization: Bearer $XBASE_API_KEY"

200 response:

{
  "workspace": { "id": "8f0c2d4e-…", "name": "My company" },
  "key": { "id": "3b1e9a77-…", "name": "Store ERP", "scopes": ["whatsapp:send"] }
}

Keep the key in an environment variable or a secrets vault, never in the code of your website or app.

Revoke and replace the keyCopy Anchor Link

On the API keys card, each key shows its last 4 characters, the creation date and the last use. Click Revoke to cut access right away. Revoking also turns off the key's webhook.

To replace a key without stopping the integration: create the new one, update the system that uses it and only then revoke the old one.

Authentication errorsCopy Anchor Link

Example:

{
  "statusCode": 401,
  "timestamp": "2026-11-04T16:03:56.074Z",
  "path": "/api/external/v1/me",
  "method": "GET",
  "message": "Chave de API inválida ou revogada.",
  "code": "INVALID_API_KEY"
}

Frequently asked questionsCopy Anchor Link

See alsoCopy Anchor Link