All Apps API requests authenticate with a personal access token. Include it as a Bearer token in the Authorization header with every request:
A personal access token acts as you, within the workspace it was created in. Each endpoint is authorized by your own permissions and the token’s settings, so a request only succeeds for an app you and the token can reach and an action you are both allowed to take. Deploying an app, for example, requires permission to publish it and a token with Full access.
Moving from an account API key?Personal access tokens replace account API keys. Since October 15, 2026, you can’t view or create an account API key, and existing keys are being switched off gradually. Replace the api_key: YOUR_API_KEY header with Authorization: Bearer YOUR_PERSONAL_ACCESS_TOKEN. A token sent in the api_key header is rejected. See moving from account API keys. Get a personal access token
You create personal access tokens in the Secrets section of your workspace settings, and choose what each token can reach and do. See Creating an access token for the steps.
Your personal access token acts as your Base44 account. Treat it like a password, don’t share it, and don’t commit it to version control.
Example request
The request body is optional. Omit checkpoint_id to deploy the app’s current version.
