Authentication

Create an API key in Worxley and send it as a Bearer token on every request.

1 min readUpdated 15 Oct 2026API v1

Create a key#

An organization admin creates API keys in Configuration → Marketplace → API & Webhooks → New key. The full key is shown once. Worxley stores only a hash, so a lost key can’t be recovered: revoke it and create a new one.

Send the key#

Keys look like wx_8f3k2m9q1a_Xp4…. Send yours in the Authorization header on every request:

X-API-Key: wx_… is accepted as well.

Keep keys on your server

Never put an API key in a browser, a mobile app or a public repository.

http

Authorization: Bearer wx_8f3k2m9q1a_Xp4yN7dQ2sLw9ZtB6vRe1HcK3mJa5uGo

What a key can see#

A key belongs to one organization and sees that organization’s records, whoever they are assigned to. Revoked and expired keys answer 401 straight away. What a key may do is set by its scopes.