API users
An API user is a credential so that your system can operate against Koywe, with no person behind it. It gets a role like any other user, but it behaves differently in two key ways.
Can / cannot
- Operate according to the role you assign it
- Go straight through when the rule allows it, with no second factor
- Be listed as an approver in a rule
- Sign with a passkey — it has no device
- Use the email code — it has no inbox
- Change the approval policy rules, ever
- Skip the approval policy: it is evaluated the same way
The two differences that matter
1. They do not sign. If the rule allows the operation, it runs instantly. That is why the same operation can go through via API and wait in the dashboard: the person signs, the credential does not. It is not a bug, they are two different paths.
2. They never manage the approval policy. An API user cannot change the rules, not even with the highest role.
If the only Super Admin user in your organization is an API user, no one can touch the approval policy rules. To unblock it, you have to contact Koywe. Make sure there is always a person with a role that can manage the approval policy.
Next steps
- Passkeys — the two ways to sign: an API user uses its key, not a passkey.
- Approval policy — how to list an API user as an approver, and with what limits.
- Passkeys & Approvals — the signing mechanics for integrations.