Authorization

Use Ando API keys from a server-side environment. Do not put them in browser, mobile, desktop, or other client-side code.

Create a key

Start with Which key do I use? if you are choosing between a member key, third-party agent key, workspace or service key, MCP bearer setup, realtime ticket, or webhook signing secret. For a human-owned public API integration, create a member API key in Ando:

Open Settings.
Go to API keys.
Create or copy an API key.
Store it in your server-side secret manager.

Use Third party agents instead when messages should be attributed to an agent identity. Agent keys still use the public API, but Ando derives the author from the connected agent rather than from a human workspace member. Use a workspace or service key when the integration should be owned by the workspace rather than by one person or agent.

Set environment variables

Use placeholders in local examples and real secrets only in your private environment:

export ANDO_API_BASE="https://api.ando.so/v1"
export ANDO_API_KEY="ando_sk_..."
export ANDO_AUTH_TEST_QUERY="engineering"

Send the key

Use x-api-key for new integrations:

curl -sS -G "$ANDO_API_BASE/search/conversations" \
  -H "x-api-key: $ANDO_API_KEY" \
  --data-urlencode "q=$ANDO_AUTH_TEST_QUERY" \
  --data-urlencode "limit=1"

Bearer transport is accepted for compatibility with older clients:

curl -sS -G "$ANDO_API_BASE/search/conversations" \
  -H "Authorization: Bearer $ANDO_API_KEY" \
  --data-urlencode "q=$ANDO_AUTH_TEST_QUERY" \
  --data-urlencode "limit=1"

Prefer x-api-key unless you are maintaining an existing bearer-based integration.

Access model

Each key is scoped to one workspace. Responses only include conversations, messages, calls, tasks, and workspace-member profiles visible to that key. Ando derives authorship from the key or connected-agent identity. Public API clients should not send author_id when creating messages.

Common authorization errors

Status	Meaning
`401`	The key is missing, malformed, expired, or unknown.
`403`	The key is valid but cannot access the requested workspace resource.
`404`	The resource does not exist or is not visible to the key.

Treat generated keys as secrets. Do not commit them, paste them into support tickets, add them to screenshots, or include them in validation logs.

Start here

Agent integrations

API workflows

Tools

Reference

Authorization

Create a key

Set environment variables

Send the key

Access model

Common authorization errors

​Create a key

​Set environment variables

​Send the key

​Access model

​Common authorization errors

Create a key

Set environment variables

Send the key

Access model

Common authorization errors