Authentication

All Viio API requests require authentication via an API key generated from the Viio dashboard.

Generating an API Key

1. Log in to the Viio dashboard.
2. Open the account menu by clicking your workspace logo in the sidebar, then go to Preferences > API Keys.
3. Click New Key.
4. Give your key a descriptive name (e.g., "CI/CD Integration" or "Custom Dashboard").
5. Select a permission scope — Full Access (Read & Write) or Full Access (Read).
6. Click Create Key.
7. Copy the generated key — it will only be shown once.

Making Authenticated GraphQL Requests

Include your API key in the Authorization header:

curl -X POST https://api.viio.io/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: YOUR_API_KEY" \
  -d '{"query": "{ applications { nodes { id name } } }"}'

Header Format

Making Authenticated Sync API Requests

The Sync API uses the same workspace API keys, but its gRPC metadata includes the ApiKey authentication scheme:

Authorization: ApiKey YOUR_API_KEY

Official SDKs attach this metadata to every request:

SyncApiAuthentication.ApiKey(apiKey)

SyncApiAuthentication.api_key(api_key)

The key must have write access and the integration:sync permission. If that permission is not available when you create a key, contact your Viio representative to enable Sync API access for the workspace.

Token Scoping

API keys are scoped to your workspace. All queries return data only for the workspace associated with the key. You cannot access data from other workspaces.

Revoking API Keys

To revoke an API key:

1. Open the account menu and go to Preferences > API Keys.
2. Find the key you want to revoke and click the ⋮ action menu.
3. Click Delete and confirm in the dialog.

Revoked keys immediately stop working. Any integrations using the key will receive 401 Unauthorized responses.