DocsConnect your AI
API keys
An API key lets a script, a CI job or an agent call Homla without a person signing in. You choose which tools it can touch.
For your own AI app, you do not need a key. Use browser sign-in instead: Connect your AI.
Create a key#
Admins manage keys in Connectors, then API keys (app.homla.ai/connectors/api-keys).
- Create API keyPress Create API key and give it a name, like
Weekly report agent. - Pick the ownerUnder Owned by, choose:
- You, a personal key. It acts as you, with your access. It stops if you leave.
- Service account. It belongs to the workspace and keeps working if someone leaves.
- Pick its accessUnder Access, choose All, Read only, or Pick connectors. With Pick connectors, set each tool to None, Read or Write.
- Copy it nowPress Create key. You can only see the key once. Store it somewhere safe.
Use it#
Send the key in the Authorization header:
Authorization: Bearer <your key>The same key works on the connector URL, for apps that take a header, and on the plain HTTP routes:
curl -H "Authorization: Bearer $HOMLA_KEY" https://app.homla.ai/v1/tools
curl -X POST -H "Authorization: Bearer $HOMLA_KEY" -H "Content-Type: application/json" \
-d '{"query":"newer_than:1d"}' https://app.homla.ai/v1/tools/gmail_mail_searchGET /v1/tools lists what the key can call. GET /v1/tools/<name> shows one action's options. POST /v1/tools/<name> runs it with your options as the JSON body.
Rename, rotate, revoke#
Each key in the list shows its name, access and when it was last used. Open its menu to Rename, Rotate (get a new secret, the old one stops) or Revoke (it stops working at once).
Treat a key like a password. Anyone who has it can do what the key allows. If one leaks, revoke it straight away.