Skip to main content
Every FormBharo API request requires an API key in the Authorization: Bearer header. Keys are tied to your account and carry the same permissions you have — if your account can read a workspace, your key can read it too. Keep your keys secure and rotate them regularly.

​
Create a key

1

Sign in to the FormBharo web app

Go to your FormBharo server URL and sign in with your account credentials.
2

Open Settings

Click your account avatar or name in the top-right corner, then select Settings from the dropdown menu.
3

Open the API keys tab

Inside Settings, click the API keys tab in the left-hand navigation.
4

Create your key

Click Create API key, enter a descriptive name (for example, production-backend or local-dev), and confirm. FormBharo generates and displays the key.
5

Copy the key immediately

The full key value is shown once only. Copy it now and store it somewhere safe — a password manager or secrets vault. If you lose it, you cannot retrieve it; revoke the key and create a new one.
Every key follows this format:

​
Send it on every request

Pass the key in the Authorization header on every authenticated request. The examples below list all your agents to verify the key is working.

​
What a key can do

A key carries its creator’s identity. It sees the same agents and workspaces you see and acts with the same role (owner, admin, member) you hold in each workspace. There is one thing a key cannot do: create or revoke other API keys — those actions require an interactive session in the web app. Treat your API key like a password. Do not commit it to source control, do not log it, and do not share it in plain text over chat or email. If a key is ever exposed, revoke it immediately and issue a replacement.

​
Revoke a key

To revoke a key, return to Settings → API keys, find the key by name, and click Revoke. The revocation takes effect immediately. The next request that uses the revoked key receives a 401 Unauthorized response.

​
Routes that don’t need a key

The following routes are intentionally open and do not require an API key:
  • POST /offer — initiates a WebRTC call session
  • GET /api/v1/data/{agent_id}/{conversation_id} — reads collected answers for a conversation
  • PATCH /api/v1/agents/{agent_id}/conversations/{conversation_id}/form_data — updates live call answers mid-conversation
  • GET /api/v1/agents/{agent_id}/public — reads the public configuration of an agent
Anyone who knows an agent ID can read and overwrite live call answers through these open routes. If you are collecting sensitive data — medical information, financial details, personal identifiers — add your own authentication layer in front of them before deploying to production. FormBharo does not enforce access control on these endpoints by design, so the responsibility lies with you.