API documentation
Authentication
Personal tokens for your scripts, OAuth 2.1 for applications and connectors: two ways to act with a member’s rights, never more.
Personal tokens
For your scripts, automations and Claude Code. A token starts with pat_ and is sent in the Authorization header.
- Create it in your workspace, menu “API & integrations”, tab “API keys”: a name, a scope, a lifetime of 30, 90, 365 days or no expiry.
- Its value is shown once, at creation: only its fingerprint is kept. You will then recognize it by its last four characters.
- At most 20 active tokens per member and per workspace.
- Revocable at any time from the same screen, with the date of last use. A member removed from the workspace loses their tokens immediately.
Authorization: Bearer pat_…OAuth 2.1 for applications
For an application acting on behalf of several members, or a connector such as claude.ai: each workspace is its own authorization server, discoverable automatically.
-
Discovery
The authorization server metadata (RFC 8414) and protected resource metadata (RFC 9728) are served on the workspace host.
GET /.well-known/oauth-authorization-server -
Registration
The application registers itself (RFC 7591) as a public client, without a secret. Accepted redirects: https, localhost and the schemes of known desktop applications.
POST /oauth/register -
Authorization
Authorization code with mandatory PKCE (S256). The member signs in (with their two-step verification), then chooses: read only, or read and write.
GET /oauth/authorize -
Tokens
The code is exchanged for an access token and a refresh token; the access token is then sent in the Authorization header, like a personal token.
POST /oauth/token
An access token lasts 60 minutes, a refresh token 30 days. The member sees every application in “API & integrations › Connected apps” and can revoke it.
Scopes
Two scopes, chosen when creating the token or by the member during OAuth consent.
| Scope | Allows |
|---|---|
read | Read only: every GET operation, plus asking the audit chat a question and previewing blurring (nothing is changed). |
write | Read and write: everything the member’s role allows. |
Operations reserved to the web app
Some actions never go through a token: they stay in the app, behind the session and its two-step verification. A token then gets 403 integrations.session_required.
- Sign-in, password, two-step verification and passkeys of the account.
- Managing tokens and authorized applications.
- Creating, replacing or deleting an AI key of the workspace: a secret never goes through a conversation.
- Granting support access to the platform team (the firm’s consent).
- The participant and sponsor surfaces, which have their own links.