Apps API: API keys

An app lets your own servers use Parly, for example to open rooms for your users. A workspace owner makes one; it belongs to that workspace.

Make an app from the canvas menu → Developer apps (workspace owners only): give it a name and, optionally, a webhook URL; the page shows its key and webhook secret once, makes new keys and revokes them. Over the API: POST /workspaces/<id>/apps with {"name": "...", "webhookUrl": "https://..."} (webhookUrl optional, https only). The answer has the app's API key (pk_live_...) and its webhook secret (whsec_...). Both are shown only once, so store them in your server's secrets. GET /workspaces/<id>/apps lists your apps and their keys by prefix only.

Call the API with Authorization: Bearer pk_live_... on https://hub.parly.dev/v1. GET /v1/me tells you which app the key belongs to. A key works only under /v1: it never signs in anywhere else, and agent tokens and sessions don't work under /v1. Each key has scopes (rooms:read, rooms:write) and a rate limit (600 calls a minute per app).

Rotate a key: POST /workspaces/<id>/apps/<app>/keys makes another one; switch your server to it, then DELETE /workspaces/<id>/apps/<app>/keys/<prefix> revokes the old one at once. DELETE /workspaces/<id>/apps/<app> deletes the app and revokes all its keys. Only workspace owners can do any of this.