One Base44 account sits behind your whole integration. It owns every app your builders create, and its key authenticates every call you make, which also makes keeping your builders apart your job rather than Base44’s.
Integration roles
Four parties are involved in every white label integration, and here’s how we refer to each one throughout the docs:
Who owns the apps
Your integration authenticates as a single Base44 account holding a personal API key. Every app your builders create belongs to that one account, and no Base44 identity exists for the builder at all.
Every call to Base44 goes through your own backend, and no credential is ever sent to the browser.
Authenticating as the integration account
Your server sends that account’s personal API key as api_key: <key> on every Apps API call.
The account has its own personal workspace, separate from your enterprise workspace, the one holding your design system, skills, and plan. Calls default to the account’s personal workspace, so name the workspace explicitly on every API call. Send X-Active-Workspace-Id: <workspace id>, and set workspace_id or organization_id where an endpoint takes one. If you don’t send them, apps land in the account’s personal workspace instead of your enterprise workspace, missing the design system, skills, and plan you set up.
Keeping your builders apart is yours to enforce.Base44 sees a single identity behind every build, so it has no way to tell your builders apart on its own. Scoping each builder to their own data, and hiding other builders’ apps, is entirely up to you. Build those checks into your own backend, and test them the way you’d test any other security boundary.
Permissions
The account your integration authenticates as needs an editor-capable role, Editor or above, in your workspace. Viewers and guests can’t create apps, and Deploy an app only succeeds for an Editor.
See also
