Authentication#

The Afosto API uses API keys to authenticate requests. Include your API key in the Authorization header of every request.

Getting an API key#

Log in to your Afosto account
Go to Settings → API
Click Create API key
Copy the key — it will only be shown once

⚠

Warning:Your API key is shown only once at creation time. Store it in a secrets manager or environment variable immediately — there is no way to retrieve it later.

Using your API key#

Pass your API key as a Bearer token in the Authorization header:

POST https://afosto.app/graphql
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Example request#

curl -X POST https://afosto.app/graphql \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { me { id email } }"}'

Security#

Keep your API key secret — treat it like a password
Never expose API keys in client-side code or public repositories
Rotate keys periodically and immediately if compromised
Use one key per integration to make it easy to revoke access