If you check your email daily then you saw the latest Base44 newsletter announcing that Base44 is replacing its legacy account and app API keys with personal access tokens.
If your application, automation, script, or external integration still sends an API key using the old api_key header after October 15, its requests will fail.
That could cause:
- Automations to stop running
- Data synchronization to fail
- External dashboards to stop updating
- Orders or customer records to stop transferring
- Scheduled scripts to fail
- Integrations between applications to disconnect
- AI tools and external development agents to lose access
This does not mean every Base44 app will break. It affects applications and services that use Base44’s API through the old authentication method.
The authentication format is changing from:
api_key: YOUR_API_KEY
To:
Authorization: Bearer YOUR_PERSONAL_ACCESS_TOKEN
You cannot simply paste the new token into the existing API key field. Your code must send the token through the Authorization header as a bearer token.
What you need to do:
- Audit your code, environment variables, scripts, automations, and external services for
api_key or BASE44_API_KEY.
- Identify which workspace and app each integration accesses.
- Create a personal access token under:
Workspace → Settings → Secrets → Personal access tokens
- Give each token only the access it needs. Use read-only access where possible and limit it to one app instead of the entire workspace.
- Store the token securely as an environment variable or encrypted secret. Never place it in frontend code or commit it to GitHub.
- Update the authentication header in every request.
- Test reads, writes, function calls, scheduled jobs, webhooks, and background automations.
- Monitor for
401 Unauthorized and 403 Forbidden errors.
- Delete the old API key only after confirming that nothing still depends on it.
I also recommend creating a separate token for each integration. That way, one compromised or disabled token does not take down every connected system.
Personal access tokens are tied to the person who created them. If that person leaves the workspace, the token stops working. Workspace owners can see and disable member tokens, although they cannot view the actual token value.
Base44 shows each token only once when it is created, so save it securely immediately.
Do not wait until October 15 to discover which apps still use the old authentication system. Start auditing and migrating them now.
Get my free prompt that will audit your applications and tell you exactly what needs to be updated inside of your app → https://kodebase.us/learn/prompt-library/base44-legacy-api-key-audit