Apollo Sender
Log in

Authentication

The public API uses workspace API keys. The product UI uses session cookies. The two stay separate.

API keys

Create keys under Developers → API keys and send them as an HTTP Bearer token on every request. Keys are hashed at rest and shown in full only once, at creation.

Authorization: Bearer <your-key>

Plan access

Programmatic access is gated by your workspace plan. If your plan doesn't include API access, authenticated requests return 403 — upgrade to enable the /v1 surface.

Session cookies

The signed-in product UI authenticates against /api/* with an Auth.js session cookie. That path is for the app itself — integrations should always use an API key against /v1, never a scraped cookie.