Skip to main content
One Base44 account sits behind your whole integration. It owns every app your builders create, and its personal access token authenticates every call you make, which also makes keeping your builders apart your job rather than Base44’s.

​
Integration roles

Four parties are involved in every white label integration, and here’s how we refer to each one throughout the docs:

​
Who owns the apps

Your integration authenticates as a single Base44 account holding a personal access token. Every app your builders create belongs to that one account, and no Base44 identity exists for the builder at all. Every call that changes an app goes through your own backend. The only credential that reaches the browser is a socket session token. The token is read-only, reaches only the apps your server allows, lasts one hour, and carries no identity.

​
Authenticating as the integration account

Your server sends that account’s personal access token as Authorization: Bearer <token> on every Apps API call. A personal access token belongs to the workspace it was created in, and only reaches that workspace. The account also has its own personal workspace, separate from your enterprise workspace, the one holding your design system, skills, and plan. Create the token in your enterprise workspace, not the account’s personal workspace, or your builds miss the design system, skills, and plan you set up. Give the token access to All apps and Superagents and Full access permission, since your integration creates, edits, and publishes apps. Name the workspace explicitly on every API call too. Send X-Active-Workspace-Id: <workspace id>, and set workspace_id or organization_id where an endpoint takes one.
Personal access tokens replace account API keys. Since October 15, 2026, you can’t view or create an account API key, and existing keys are being switched off gradually. If your integration still sends api_key: <key>, replace that header with Authorization: Bearer <token>. See moving from account API keys.
Keeping your builders apart is yours to enforce.Base44 sees a single identity behind every build, so it has no way to tell your builders apart on its own. Scoping each builder to their own data, and hiding other builders’ apps, is entirely up to you. Build those checks into your own backend, and test them the way you’d test any other security boundary.

​
Open socket sessions

To show builds in the browser as they happen, your server also holds a workspace API key with the Watch app builder updates permission. Your server sends the key as Authorization: Bearer <key> to open a socket session, and returns only the session token to the browser. The key never leaves your server.

​
Permissions

The account your integration authenticates as needs an editor-capable role, Editor or above, in your workspace. Viewers and guests can’t create apps, and Deploy an app only succeeds for an Editor.

​
See also