Can one app expose boards from several projects?

No, an app belongs to one project. Create one app per project, or put related boards in the same project.

Is there an OpenAPI document?

Yes. The developer manual describes the app API and the public API with OAuth2 for the admin surface; `get_app_spec` returns the per-app contract as JSON.

How do I rotate a key?

Create a second key, switch your server to it, then delete the first. Keys are listed and revocable in the app settings.

Give your Claude-built app a REST API: endpoints, keys, row-level security

The model in one paragraph

An app is a named API surface over the boards of one project. An endpoint exposes one board at /apps/{appSlug}/api/{slug} with a chosen set of methods and columns. An API key belongs to the app and is sent as a bearer token. Optionally, an endpoint is per-user: the caller adds X-App-User: <id> and only that user's rows are visible. Everything else, validation by column type, audit log, the admin UI, is inherited from the board.

Creating it from Claude Code

Create an app "portal" over the Bookings project. Expose Bookings as endpoint "bookings" with GET, POST and PATCH, exposing only date, time, service, status and notes; status read-only. Enable row-level security so each customer sees only their bookings. Create an API key named "web".

The tools involved: create_app, create_app_endpoint (with exposedColumns and rowLevelSecurity), create_app_api_key, then get_app_spec to read the final contract. Always build the client from the spec, not from memory: it carries the absolute base URL, the aliases and the field types.

Calling it

# list this customer's bookings
curl "https://api.tasklite.net/apps/portal/api/bookings" \
  -H "Authorization: Bearer <app key>" \
  -H "X-App-User: cust_8831"

# create one
curl -X POST "https://api.tasklite.net/apps/portal/api/bookings" \
  -H "Authorization: Bearer <app key>" -H "X-App-User: cust_8831" \
  -H "Content-Type: application/json" \
  -d '{"date":"2026-09-12","time":"10:30","service":"Haircut","notes":"same as last time"}'

The response is the row as the endpoint exposes it, with the ids you need for a later PATCH. Dates and times are validated by the column type; a wrong format is a 400 with the field named.

Where the key lives

Server-side, always. A Next.js route handler, a serverless function, a Cloudflare Worker, an environment variable on your backend. A key in browser code is a key anyone has, and with it every row the endpoint can reach. The X-App-User header is set by your server after it authenticated the user with whatever auth you use; TaskLite trusts the header because it trusts the key.

Pattern	Safe?	Notes
Key in a Next.js route handler, browser calls your route	Yes	The standard setup
Key in a mobile app binary	No	Extractable. Put a thin server in between
Key in a browser bundle for a read-only public endpoint	Mostly not	Read-only still exposes all rows; use a server or a public form
Per-user endpoint without X-App-User	Rejected	Returns 401 by design

Exposed columns and aliases

Expose the minimum. A customer-facing endpoint should not carry internal notes, cost prices or the assignee. Aliases let the API speak your frontend's language (due_date instead of a column named "מועד יעד") while the board keeps its own names; renaming a column in the admin does not break the client as long as the alias stays.

Errors you will meet

401 on a per-user endpoint: missing X-App-User. Not a key problem.
404 with "Wrong host": you called app.tasklite.net. The API is on api.tasklite.net; use the base URL from get_app_spec.
400 naming a field: type validation. Check the column type in the spec.
403 on PATCH: the column is read-only in the endpoint, or the method is not allowed.
429: rate limited. Back off and batch; the limits are generous for app traffic but not for a loop that polls every second.

Webhooks the other way

When the business changes a row in the admin, your app can hear about it: an automation with an HTTP action posts the row to your URL on status change, on creation, on a date. That is how a "your order shipped" email or a partner sync works without polling.