Authentication
Organization API keys and the X-API-Key header.
Every request carries an API key in the X-API-Key header:
curl https://app.aftertalk.co/api/v1/projects \
-H "X-API-Key: at_live_abc12345_..."Keys belong to the organization
A key is owned by your organization, not by the person who created it. An integration keeps working after the admin who set it up changes roles or leaves the company.
A key can read and write every project in its organization, and usage is billed to the organization's plan.
Creating a key
In the app, go to Organization → Settings → API keys and create one. You need to be an owner or admin of the organization. The full key is shown once, at creation — store it somewhere safe; only its prefix is visible afterwards.
Keys look like this:
at_live_<8-char id>_<secret>The first part identifies the key, the second is the secret. Optionally set an expiry date at creation, and deactivate or delete a key at any time — both take effect immediately.
What a key cannot do
Keys are for automating work inside your organization, so a few things stay out of reach:
- Creating or managing API keys (no key can mint another key)
- Deleting a project or a call
- Billing, account, organization membership, and admin operations
- Anything requiring a logged-in session or 2FA
Those return 401 for a key.
Keeping keys safe
A key can read and change everything in your organization's projects — guard it like an admin password. Keep it server-side — never ship it in a browser app, mobile binary, or public repository.
If a key leaks, delete it under Organization → Settings → API keys; requests with it stop working immediately. Create separate keys per integration so you can delete one without breaking the others.