Authentication
How to authenticate requests to the WebPixie GraphQL API with an API key and secret.
Requests to the WebPixie API are authenticated with HTTP Basic authentication, using an API key as the username and its secret as the password.
Some features and limits mentioned on this page vary by plan. Visit our Pricing page to review the plans.
Creating an API Key
Create and manage API keys from the API Users page. Each key is issued together with its own secret at creation time.
Sending the Header
Send the key and secret together as api_key:api_secret in the Authorization header:
Authorization: Basic base64("api_key:api_secret")Most HTTP clients build this header for you when given a username and password. With curl:
curl https://app.webpixie.io/graphql \
-u "your_api_key:your_api_secret" \
-H "Content-Type: application/json" \
-d '{"query": "{ myUser { id } }"}'Permissions
An API key acts with the same workspace role as the user who created it. Changing data (any mutation) requires the Owner or Admin role; a key created by a user with a lower role can only read. A key can be read-only: it can run queries but every mutation is rejected with a read-only error. A key's access can also be narrowed to specific sites and uptime monitors. A narrowed key only sees those resources in lists and incidents. A key limited to specific sites cannot create sites, a key limited to specific monitors cannot create monitors, and either limit also blocks creating, changing, or deleting tags and folders.
Plan Requirement
API access must be enabled on your workspace's plan. If it isn't, requests are rejected even with valid credentials — visit our Pricing page to review which plans include API access.
Rate Limits
Repeated failed authentication attempts from the same source are temporarily blocked. While blocked, requests are rejected with HTTP 429 even if the credentials are valid. Wait and try again later instead of retrying in a loop.