Skip to content

Authentication

Every request carries an API token in the Authorization header:

Authorization: Bearer $ELAICHI_API_TOKEN

A token belongs to one organization and to the person who created it. Requests run with that person's permissions — a token can never do more than they can.

Create a token

  1. Sign in at app.elaichi.ai and switch to the organization you want to automate.
  2. Open Settings → API tokens.
  3. Choose Create and name the token after where it will be used, such as CI pipeline.
  4. Copy the token now. It's shown once and can't be retrieved later.
  5. Store it in a password manager or your secret store — never in source control.

The Create API tokens guide walks through the same screen with more detail.

Use it

curl https://api.elaichi.ai/connection \
  -H "Authorization: Bearer $ELAICHI_API_TOKEN"

Keep the token in an environment variable rather than pasting it into scripts.

Permissions

Most endpoints that change something require a specific permission, such as creating a toolbox. Those permissions come from the roles of the person who created the token, so:

  • Changing their roles changes what the token can do, immediately.
  • Revoking the token cuts access straight away.

A 403 forbidden response means the token is valid but the underlying account lacks the permission. Check that person's roles in Members & Roles.

Rotate and revoke

Delete a token from Settings → API tokens the moment it's no longer needed, or if it might have leaked. Revocation is immediate and can't be undone — create a new token and update your integration.

For a leaked token, revoke first and rotate second. It's the fastest way to close the gap.