Get started
Authentication
Every request carries your workspace context and one credential: an API key or an OAuth 2.0 access token.
Workspace header
Send it on every request. Without it the API answers 400 ACCOUNT_CONFIGURATION_ERROR.
| Header | Value |
|---|---|
x-tenant-id | Your workspace subdomain, e.g. acme for acme.inaiy.com. |
Integrations built before November 2026 may also send x-product-id. That still works — the header is accepted and ignored, so there is nothing to change.
API keys
Best for server-side integrations you control. Create keys in Settings → Developer → API keys. A key has full access to the workspace (no scopes), so keep it on your server and never ship it in a browser or mobile app.
x-tenant-id: acme
x-api-key: wp_live_xxxxxxxxxxxxxxxxxxxxYou can also send the key as Authorization: Bearer wp_live_…. Keys prefixed wp_test_ are for testing. Rotate a key by creating a new one, deploying it, then disabling the old one.
OAuth 2.0 access tokens
Use OAuth when you build an app other inaiy workspaces install — a CRM connector, an e-commerce plugin or an agency tool. The workspace admin approves the scopes your app asks for, and every endpoint checks the scope it needs (shown on each endpoint in the API reference).
x-tenant-id: acme
Authorization: Bearer wp_at_xxxxxxxxxxxxxxxxxxxxAccess tokens start with wp_at_ and last one hour; refresh them with the refresh token. See the OAuth 2.0 guide.
Which one should I use?
| API key | OAuth 2.0 | |
|---|---|---|
| Who uses it | Your own backend | Apps installed by other workspaces |
| Access | Full workspace | Only the approved scopes |
| Lifetime | Until you disable it | 1-hour access token + rotating refresh token |
| Revocation | Disable in Settings | POST /oauth/revoke or the admin removes the app |
Keep credentials server-side
Trying requests while signed in
Signed in to your workspace? The in-app API Explorer sends requests with your dashboard session, so you can try endpoints without creating a key.