API authentication

Use an APOB API key for programmatic access to POST /graphql. The key identifies its owning account without requiring a Firebase login token. The account must remain active, and operation-specific role and resource permissions still apply.

Authenticate with an API key

Send the complete key, including its apob_ prefix, as a Bearer credential:

API key headers

Content-Type: application/json
Authorization: Bearer <APOB_API_KEY>

An APOB API key has the apob_ prefix followed by 32 characters. Store the full value in server-side secret storage. Keep it out of browser bundles, URLs, prompts, logs, and public repositories.

Obtain and manage keys

Sign in through your APOB integration and create a key for the account whose resources and credits you intend to use. API-key access must be enabled for that account. See account and API keys for creation, listing, and revocation operations. The complete secret is returned once during creation. A later listing returns metadata, not the secret. Keys can expire or be revoked; replace an exposed key and revoke the old one. A missing, malformed, expired, or revoked APOB key cannot authorize protected operations. Signed-in integrations retain their Firebase login flow. They can authenticate GraphQL with the raw Firebase ID token in X-Firebase-Token:

Firebase login headers

Content-Type: application/json
X-Firebase-Token: <FIREBASE_ID_TOKEN>

Use a token from the integration’s configured Firebase project that maps to an active APOB account. In an already initialized and signed-in Firebase application:

Firebase JavaScript SDK

import { getAuth, getIdToken } from "firebase/auth";

const user = getAuth().currentUser;
if (!user) {
  throw new Error("Sign in to APOB before calling GraphQL");
}
const idToken = await getIdToken(user);

Use your integration’s configured Auth instance if it uses a named Firebase app. The Firebase SDK refreshes tokens when needed. See Firebase’s ID token retrieval guidance and JavaScript Auth reference.

Choose one credential

Send the credential appropriate to your integration. When an APOB API key is provided, the key’s account owns the call, even if a Firebase token for another account is also present. An invalid APOB key is rejected; it does not fall back to Firebase login. A valid key’s identity is independent of Firebase token state. MCP OAuth access tokens, Firebase custom tokens, and provider access tokens are not APOB API keys and do not replace a supported GraphQL credential.

WebSocket authentication

The GraphQL WebSocket path is /graphql. A client that supports custom handshake headers can send Authorization: Bearer <APOB_API_KEY>. The key is checked at connection initialization and again for each operation, including revocation and expiration checks. Reconnect with a replacement key when necessary. Browser clients using graphql-transport-ws can retain Firebase authentication through the connection_init payload:

Firebase connection initialization

{
  "type": "connection_init",
  "payload": {
    "firebaseToken": "<FIREBASE_ID_TOKEN>"
  }
}

Firebase identity is also revalidated for each operation. Reconnect after token expiry or an account switch. A connection acknowledgement does not grant indefinite access. Do not put an API key in the Firebase token field.

Resource IDs and errors

modelId, contentId, mediaIds, and voiceModelId select business resources; they do not authenticate the caller. Resource permissions still apply.

Message code	Meaning	Action
`100101`	Required authentication is missing or invalid.	Check the key’s value, expiry, and revocation, or refresh the Firebase token for a login-based call.
`100102`	Identity verification or account lookup is temporarily unavailable.	Back off before another read. Reconcile any uncertain mutation before submitting again.
`110202`	The account lacks permission.	Use an operation and resource allowed for the authenticated account.
`110206`	The account has been deleted.	Stop protected operations for that account.

Public queries may allow anonymous reads, but protected fields in the same selection still require authentication. Inspect GraphQL errors even after HTTP 200; an invalid APOB API key can be rejected with HTTP 401 before operation execution. See errors.

Get started

Core concepts

Workflows

GraphQL API

Usage and troubleshooting

Authenticate with an API key

Obtain and manage keys

Choose one credential

WebSocket authentication

Resource IDs and errors

​Authenticate with an API key

​Obtain and manage keys

​Firebase login authentication

​Choose one credential

​WebSocket authentication

​Resource IDs and errors

Authenticate with an API key

Obtain and manage keys

Firebase login authentication

Choose one credential

WebSocket authentication

Resource IDs and errors