Keys and authenticationPro

Every request to the API carries a key. Keys belong to your organisation and are managed by its admins.

Creating a key

1. Go to Organisation Settings > API.
2. Choose Create key and give it a name, like the tool it’s for.
3. Choose when it Expires: after 30 days, 90 days, a year (the default), or never.
4. Copy the key from the window that opens and keep it somewhere safe, like your password manager or the tool’s own settings.

The key is shown once. Folke only keeps a scrambled copy, so it can’t show it to you again. If you lose it, revoke it and create another.

Make one key for each tool you connect. Then you can stop one without stopping the others, and Last used tells you which are still in use. An organisation can have up to 10 keys.

Sending the key

Put the key in the Authorization header of every request, after the word Bearer:

curl https://api.myfolke.com/api/v1/org/people \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Accept: application/json"

Never put a key in a web page or anything that runs in a browser, where anyone can read it. Call the API from a server or a script.

When a key stops working

A key acts as the admin who created it. It stops working:

• when it’s revoked under Organisation Settings > API, straight away;
• when it expires, at the end of the day shown under Expires. The list marks it Expired for a day, then it’s removed. A key that has expired is answered with 401, so create a new one before the date to keep a tool running;
• while the admin who made it isn’t an admin any more. The key list marks it Stopped. Create a new key from an admin’s account to replace it;
• while your organisation isn’t on Pro, or its subscription has lapsed.

Changing a password or signing out everywhere doesn’t affect keys. They belong to the organisation, not to a device.

What a key can’t do

A key only reads, and only from the addresses in this guide. It can’t book or approve leave, change settings, or reach any other part of Folke, even ones that only read. A request it can’t make is answered with 403 and the reason api_key_not_allowed.