> ## Documentation Index
> Fetch the complete documentation index at: https://developers.apob.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication

> Call GraphQL with an APOB API key, or use Firebase authentication for a signed-in integration.

Use an APOB API key for programmatic access to `POST /graphql`. The key identifies
its owning account without requiring a Firebase login token. The account must
remain active, and operation-specific role and resource permissions still apply.

## Authenticate with an API key

Send the complete key, including its `apob_` prefix, as a Bearer credential:

```http API key headers theme={null}
Content-Type: application/json
Authorization: Bearer <APOB_API_KEY>
```

An APOB API key has the `apob_` prefix followed by 32 characters. Store the full
value in server-side secret storage. Keep it out of browser bundles, URLs, prompts,
logs, and public repositories.

### Obtain and manage keys

Sign in through your APOB integration and create a key for the account whose
resources and credits you intend to use. API-key access must be enabled for that
account. See [account and API keys](/api-reference/account) for creation, listing,
and revocation operations.

The complete secret is returned once during creation. A later listing returns
metadata, not the secret. Keys can expire or be revoked; replace an exposed key
and revoke the old one. A missing, malformed, expired, or revoked APOB key cannot
authorize protected operations.

## Firebase login authentication

Signed-in integrations retain their Firebase login flow. They can authenticate
GraphQL with the raw Firebase ID token in `X-Firebase-Token`:

```http Firebase login headers theme={null}
Content-Type: application/json
X-Firebase-Token: <FIREBASE_ID_TOKEN>
```

Use a token from the integration's configured Firebase project that maps to an
active APOB account. In an already initialized and signed-in Firebase application:

```javascript Firebase JavaScript SDK theme={null}
import { getAuth, getIdToken } from "firebase/auth";

const user = getAuth().currentUser;
if (!user) {
  throw new Error("Sign in to APOB before calling GraphQL");
}
const idToken = await getIdToken(user);
```

Use your integration's configured Auth instance if it uses a named Firebase app.
The Firebase SDK refreshes tokens when needed. See Firebase's
[ID token retrieval guidance](https://firebase.google.com/docs/auth/admin/verify-id-tokens#retrieve_id_tokens_on_clients)
and [JavaScript Auth reference](https://firebase.google.com/docs/reference/js/auth#getidtoken).

## Choose one credential

Send the credential appropriate to your integration. When an APOB API key is
provided, the key's account owns the call, even if a Firebase token for another
account is also present. An invalid APOB key is rejected; it does not fall back
to Firebase login. A valid key's identity is independent of Firebase token state.

MCP OAuth access tokens, Firebase custom tokens, and provider access tokens are
not APOB API keys and do not replace a supported GraphQL credential.

## WebSocket authentication

The GraphQL WebSocket path is `/graphql`. A client that supports custom handshake
headers can send `Authorization: Bearer <APOB_API_KEY>`. The key is checked at
connection initialization and again for each operation, including revocation and
expiration checks. Reconnect with a replacement key when necessary.

Browser clients using `graphql-transport-ws` can retain Firebase authentication
through the `connection_init` payload:

```json Firebase connection initialization theme={null}
{
  "type": "connection_init",
  "payload": {
    "firebaseToken": "<FIREBASE_ID_TOKEN>"
  }
}
```

Firebase identity is also revalidated for each operation. Reconnect after token
expiry or an account switch. A connection acknowledgement does not grant
indefinite access. Do not put an API key in the Firebase token field.

## Resource IDs and errors

`modelId`, `contentId`, `mediaIds`, and `voiceModelId` select business resources;
they do not authenticate the caller. Resource permissions still apply.

| Message code | Meaning | Action |
| - | - | - |
| `100101` | Required authentication is missing or invalid. | Check the key's value, expiry, and revocation, or refresh the Firebase token for a login-based call. |
| `100102` | Identity verification or account lookup is temporarily unavailable. | Back off before another read. Reconcile any uncertain mutation before submitting again. |
| `110202` | The account lacks permission. | Use an operation and resource allowed for the authenticated account. |
| `110206` | The account has been deleted. | Stop protected operations for that account. |

Public queries may allow anonymous reads, but protected fields in the same
selection still require authentication. Inspect GraphQL `errors` even after HTTP
200; an invalid APOB API key can be rejected with HTTP 401 before operation
execution. See [errors](/api-reference/errors).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.