Authentication

Every request carries an API key in the X-API-Key header:

curl https://app.aftertalk.co/api/v1/projects \
  -H "X-API-Key: at_live_abc12345_..."

Keys belong to the organization

A key is owned by your organization, not by the person who created it. An integration keeps working after the admin who set it up changes roles or leaves the company.

A key can read and write every project in its organization, and usage is billed to the organization's plan.

Creating a key

In the app, go to Settings → API keys and create one. You need to be an owner or admin of the organization. The full key is shown once, at creation — store it somewhere safe; only its prefix is visible afterwards.

Keys look like this:

at_live_<8-char id>_<secret>

The first part identifies the key, the second is the secret. Optionally set an expiry date at creation, and deactivate or delete a key at any time — both take effect immediately.

What a key cannot do

Keys are for automating your own workspace, so a few things stay out of reach:

• Creating or managing API keys (no key can mint another key)
• Deleting a project or a call
• Billing, account, organization membership, and admin operations
• Anything requiring a logged-in session or 2FA

Those return 401 for a key.

Keeping keys safe

If a key leaks, delete it in Settings → API keys; requests with it stop working immediately. Create separate keys per integration so you can revoke one without breaking the others.