Skip to main content
API requests authenticate with an integration token. Each integration has one token, labeled Secret in the app.

​
Token format

A token is bti_ followed by 43 characters: letters, digits, _, and -. App login tokens can’t call this API, and integration tokens can’t call any other Bottari feature.

​
Manage a token

Only team owners can see tokens. Open the integration under Settings → API integrations and use the Secret row. Delete integration rejects requests with that token immediately and removes all its connections. Rows the deleted integration’s bot wrote keep the bot’s ID. Creating an integration, regenerating a token, and creating a webhook subscription share a limit of 10 per hour per team. A team can have up to 25 integrations.

​
Authentication errors

The server checks the path, then JSON, authentication, version, and body. An unknown path returns 400 invalid_request_url before the token is read.

​
Integration bot

Each integration has a bot user. The id from GET /v1/users/me is that bot’s ID.
  • It appears in created_by on rows the integration creates and last_edited_by on rows it updates.
  • It appears in webhook authors as { "id": "<bot id>", "type": "bot" }. Use it to skip your own changes.
  • The integration stays when the person who created it or connected a database leaves the team.

​
Keep tokens safe

  • Store tokens in environment variables or a secret manager. Never put them in code sent to a browser.
  • Create a separate integration for each job, turn on only the capabilities it needs, and connect only the databases it needs.
  • If a token leaks, select Regenerate to block the old one immediately.
  • Integration reads and writes and token views are recorded in the team audit log.