Developers

API keys

An API key lets your code use the REST API as you. A request made with your key can do exactly what you can do in the app, in every app you can open, and nothing more. When your access to an app changes, what the key can do there changes too.

#Create a key

1. Open Settings (account menu → Settings) and find API keys.
2. Give the key a name that says where it's used, for example Website contact form.
3. Choose when it expires: in 30 days, 90 days (the default), 1 year, or never.
4. Select Create key and copy the key. It is shown only once. appTown stores only a fingerprint of it, so nobody (not even support) can show it to you again.

Keys look like at_ followed by 43 letters, digits, - and _. The list shows the first few characters so you can tell your keys apart.

#Use a key

Send it in the Authorization header of every request:

curl https://apptown.app/api/v1/me \
  -H "Authorization: Bearer at_your_key_here"

/api/v1/me returns the account the key acts as, which is a quick way to check that the key works.

#Keep keys safe

• Treat a key like a password. Never put it in a web page, a mobile app or a public repository. Use it only from a server or a script you control.
• Use a separate key for each place you use one, so you can revoke one without breaking the others.
• Prefer keys that expire. You can have up to 20 working keys.

#Revoke a key

Select Revoke next to the key in Settings. Anything that uses the key stops working at once. Signing out everywhere does not revoke keys; revoke them separately.