Skip to main content
An authenticates programmatic requests to Alforse. Each key belongs to one company and has explicit permission scopes. A request can do only what the key’s scopes and its creator’s current permissions both allow. Manage keys under Settings → API Keys.

​
Creating a key

Select New API Key, enter a company-unique Name, optionally set Expires At, grant scopes, and save. A blank expiration means the key does not expire. Alforse displays the full key once and then stores only its SHA-256 hash and a five-character preview. Copy the key immediately; if it is lost, delete it and create another. The dialog also provides an MCP connection command.

​
Authenticating a request

Send an Alforse API key as a bearer token. The service-layer API uses POST /api/v1/{module}/{operation}; the public API host is https://api.alforse.com.
API keys require no login or refresh flow. Alforse hashes each submitted key and checks its record, expiration, and rate limit before processing the request.

​
Scopes and rate limit

A key has only its stored module_action scopes, such as sales_view or inventory_create, limited to what its creator can currently do, and can access only its company. A key with no scopes can authenticate but cannot read or write data. Scope changes and deletion take effect immediately. API access requires the Business or Partner plan (feature API_KEYS); requests from a Starter-plan company return 403 regardless of scope. New keys allow 60 requests per minute (window 1m; a platform policy can also use 1h or 1d windows). Each key’s limit is shown in the Rate Limit column and counted per key. You cannot change it in the app; if an integration needs more, contact Alforse support. A rejected request returns 429 (Rate limit exceeded) with Retry-After and X-RateLimit-* headers; retry after the specified interval.

​
What the key unlocks

Use the Alforse API by default. It validates input, updates derived data, and enforces permissions through Alforse’s service layer. Each operation accepts the same arguments over HTTP at POST /api/v1/{module}/{operation} and through MCP. Operations are classified as READ, WRITE, or DESTRUCTIVE so clients can gate them by risk. The reference includes examples and an OpenAPI specification for generating client SDKs. The Data API provides direct REST access to tables and views under the app’s row-level security policies.

​
Keys versus webhooks

An API key authorizes requests to Alforse. A webhook notifies your service when a subscribed record changes. They are independent: a webhook is signed with its own signing secret, never with an API key. A typical integration uses the webhook as a change notification, then fetches the current record with an API key.