Skip to main content
An API key is a single credential that grants access to everything in your organization. There is no per-user or per-resource restriction: any endpoint reachable with the key operates across the whole organization. Treat a key as a privileged secret.
If your integration is used by more than one person, or a call should never reach data its user cannot see, use OAuth Apps instead.

​
Base URL

​
Authentication

Include your API key in every request using the X-API-Key header:

​
API Key Format

API keys follow the format ca_<base64url_encoded_string>. Example: ca_xYz123AbCdEfGhIjKlMnOpQrStUvWxYz

​
Obtaining a key

Generate an API key from the Chamelio web application. The full key value is shown once, at creation - store it in your secret manager before closing the dialog.

​
Verifying a key

A 200 response confirms the key is valid and shows which organization it belongs to.

​
Authentication Errors

The API returns 401 Unauthorized with one of the following messages: It returns 403 Forbidden when the key is valid but the user who created it is no longer an active member of the organization:
A key rejected this way is revoked, not merely refused. Deactivating a user permanently invalidates every API key they created, and reactivating them does not bring the keys back - create new ones. Before offboarding someone, check which integrations depend on keys they own.

​
Rate Limiting

Requests are rate limited per API key, using a one-minute window. Every authenticated response carries the current state: Once the limit is exceeded the API returns 429 Too Many Requests with a Retry-After header holding the number of seconds until the window resets:
Your key’s limit is reported as rate_limit_per_minute by Get Organization Info.

​
Attribution

Actions taken with an API key are attributed to the user who created the key. Several endpoints also accept an explicit user_email in the request body to attribute an action to a specific member of your organization instead.

​
Available endpoints

Everything under API Key Access in the navigation. Start with:

Get Organization Info

Your organization’s name, legal entities, and rate limit

Upload Document

Upload documents to Core for processing

List Workflows

Every workflow available in your organization

Initiate Workflow

Start a new workflow task with specified variables

​
Security notes

An API key is organization-wide. Anyone holding it can read and modify any document, workflow, and task in your organization. Never ship a key in client-side code, a mobile app, or a browser extension - use an OAuth application with a public client for those.
Issue a separate key per integration. That way you can revoke one integration’s access, and read its usage, without disrupting the others.