Skip to content
Apploye

Authentication guide

Apploye Partner API uses API key authentication. Every request must include a valid partner API key.

API key header

HeaderRequiredDescription
X-APPLOYE-API-KEYYesYour organization-scoped partner API key

Example:

GET /v1/timesheet_idle_times/?start_date=2025-06-01&end_date=2025-06-07 HTTP/1.1
Host: api.apploye.com
X-APPLOYE-API-KEY: your_api_key_here
Accept: application/json

How validation works

There is no separate authorizer service. Each read Lambda validates your API key at the start of every request using a shared platform module:

  1. The key is looked up in Apploye PostgreSQL.
  2. A valid key resolves to your organization_id.
  3. All data returned is scoped strictly to that organization.

Your API key determines which organization you can read. You cannot access another tenant's data by changing query parameters.

Valid keys are cached briefly inside each warm Lambda instance. Cached keys are re-checked against the database every 30 seconds (configurable by Apploye). After you revoke a key, it may continue to work for up to that interval on instances that already cached it; cold instances and other instances reject it immediately.

Error responses

HTTP statusCodeWhen
401INVALID_API_KEYMissing, invalid, or revoked API key
403FORBIDDENValid key but the resource is not allowed

Example 401 response:

{
  "error": {
    "code": "INVALID_API_KEY",
    "message": "Invalid or missing API key.",
    "request_id": "req_abc123"
  }
}

Key rotation

  1. Request a new API key from Apploye (your account manager or support channel).
  2. Update your integration to use the new key.
  3. Verify reads succeed with the new key.
  4. Revoke the old key after a cutover window.

Revocation is not instantaneous on every server: allow at least 30 seconds after revoking a key before assuming all traffic with that key has stopped.

Never commit API keys to source control or log them in your application.

Security practices

  • Use HTTPS only (https://api.apploye.com).
  • Store keys in a secrets manager or environment variables.
  • Rotate keys periodically and immediately if a key may have been exposed.

Related docs