> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tenancy and credentials

> The single account that owns every app your builders build, and the credential your server calls Base44 with.

One Base44 account sits behind your whole integration. It owns every app your builders create, and its key authenticates every call you make, which also makes keeping your builders apart your job rather than Base44's.

## Integration roles

Four parties are involved in every white label integration, and here's how we refer to each one throughout the docs:

| Role                   | What it does                                                                                                 |
| :--------------------- | :----------------------------------------------------------------------------------------------------------- |
| Base44                 | Provides the harness that runs the app build behind your API calls.                                          |
| Your platform          | Owns sign-in, tenancy, billing, and everything your users see.                                               |
| A builder              | One of your platform's users, who describes an app and answers the questions the agent asks while it builds. |
| An end user (optional) | Someone who uses the published app, without participating in a build.                                        |

## Who owns the apps

Your integration authenticates as a single Base44 account holding a personal API key. Every app your builders create belongs to that one account, and no Base44 identity exists for the builder at all.

Every call to Base44 goes through your own backend, and no credential is ever sent to the browser.

## Authenticating as the integration account

Your server sends that account's personal API key as `api_key: <key>` on every [Apps API](/developers/references/apps-api/get-started/overview) call.

The account has its own personal workspace, separate from your enterprise workspace, the one holding your design system, skills, and plan. Calls default to the account's personal workspace, so name the workspace explicitly on every API call. Send `X-Active-Workspace-Id: <workspace id>`, and set `workspace_id` or `organization_id` where an endpoint takes one. If you don't send them, apps land in the account's personal workspace instead of your enterprise workspace, missing the design system, skills, and plan you set up.

<Warning>
  **Keeping your builders apart is yours to enforce.**

  Base44 sees a single identity behind every build, so it has no way to tell your builders apart on its own. Scoping each builder to their own data, and hiding other builders' apps, is entirely up to you. Build those checks into your own backend, and test them the way you'd test any other security boundary.
</Warning>

## Permissions

The account your integration authenticates as needs an editor-capable role, Editor or above, in your workspace. Viewers and guests can't create apps, and [Deploy an app](/api-reference/deploy-an-app) only succeeds for an Editor.

## See also

* [Setup checklist](/developers/white-label/setup-checklist): Everything you need to do to get an integration running
* [Design system](/developers/white-label/design-system): Put your brand on everything your builders build
* [Apps API reference](/developers/references/apps-api/get-started/overview): Every endpoint this page builds on, including the personal API key