DocsConnect your AI

API keys

An API key lets a script, a CI job or an agent call Homla without a person signing in. You choose which tools it can touch.

For your own AI app, you do not need a key. Use browser sign-in instead: Connect your AI.

Create a key#

Admins manage keys in Connectors, then API keys (app.homla.ai/connectors/api-keys).

  1. Create API keyPress Create API key and give it a name, like Weekly report agent.
  2. Pick the ownerUnder Owned by, choose:
    • You, a personal key. It acts as you, with your access. It stops if you leave.
    • Service account. It belongs to the workspace and keeps working if someone leaves.
  3. Pick its accessUnder Access, choose All, Read only, or Pick connectors. With Pick connectors, set each tool to None, Read or Write.
  4. Copy it nowPress Create key. You can only see the key once. Store it somewhere safe.

Use it#

Send the key in the Authorization header:

HTTP header
Authorization: Bearer <your key>

The same key works on the connector URL, for apps that take a header, and on the plain HTTP routes:

Terminal
curl -H "Authorization: Bearer $HOMLA_KEY" https://app.homla.ai/v1/tools
curl -X POST -H "Authorization: Bearer $HOMLA_KEY" -H "Content-Type: application/json" \
  -d '{"query":"newer_than:1d"}' https://app.homla.ai/v1/tools/gmail_mail_search

GET /v1/tools lists what the key can call. GET /v1/tools/<name> shows one action's options. POST /v1/tools/<name> runs it with your options as the JSON body.

Rename, rotate, revoke#

Each key in the list shows its name, access and when it was last used. Open its menu to Rename, Rotate (get a new secret, the old one stops) or Revoke (it stops working at once).

Treat a key like a password. Anyone who has it can do what the key allows. If one leaks, revoke it straight away.