Skip to main content

Public API

note

Tier: Starter, Professional, Enterprise

The Passwd Public API lets you manage password records programmatically: from CI/CD pipelines, internal tooling, or any script that needs to read or write secrets stored in Passwd.

The API supports creating, listing, reading, updating, and deleting records. Every request is authenticated with a personal API key that you generate in the Passwd app.

Quickstart​

  1. In the Passwd web app, open your profile menu in the left sidebar and select API keys, then generate a new key. The key is shown only once, so copy it right away. See Managing API keys for details.

  2. Find your API base URL. The Public API runs on a different host than the web app:

    PlanAPI base URL
    Starter, Professionalhttps://api.passwd.team
    EnterpriseCloud Run URL of your backend, https://passwd-backend-<id>-<region>.a.run.app. Your administrator finds it in the Google Cloud console under Cloud Run. A custom API domain, if your instance has one, works too.

    app.passwd.team (or company.passwd.team) is the web app, not the API. Requests to /api/... there return the web page.

  3. Call the API. The examples use api.passwd.team. On Enterprise, use your backend URL instead. The example below creates a password record:

curl -X POST "https://api.passwd.team/api/v2/public/secrets" \
  -H "Authorization: Bearer pswd_ak_..." \
  -H "Content-Type: application/json" \
  -d '{
    "type": "password",
    "name": "Amazon",
    "username": "team@example.com",
    "password": "correct-horse-battery-staple",
    "web": "https://amazon.com"
  }'
  1. List your records:
curl "https://api.passwd.team/api/v2/public/secrets" \
  -H "Authorization: Bearer pswd_ak_..."

That's it. The full list of endpoints, record types, and error codes is in the API reference.

How access works​

An API key acts on behalf of the user who created it. Requests made with the key can access exactly the records the user can access in the app, nothing more. Keys are tied to the user account and stop working when the user is removed from your Google Workspace.

Plan limits​

The Public API applies the same plan limits as the app. On the Starter plan:

  • The organization can hold 15 records.
  • TOTP is available on 2 records. The API rejects TOTP only on a record that has no TOTP yet.
  • Responses omit the security-audit fields securityLevel, passwordUpdatedAt, passwordHashed and ignoreSecurityReport.

A blocked request returns HTTP 402. The body carries errorCode e2000 (records) or e2003 (TOTP) and errorData with limit and current. The Professional and Enterprise plans have no such limits.

Learn more​

  • Managing API keys: how to generate, inspect, and revoke keys, and where to store them.
  • API reference: endpoints, request and response schemas for every record type, and error responses.