> For the complete documentation index, see [llms.txt](https://developers.gallantreecapital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.gallantreecapital.com/getting-started/register-an-app.md). # Register an app Everything you do with the Gallantree Developer API is scoped to a **developer app**. An app owns: * One or more **API keys** (with a visible prefix, a hashed body, and an expiry). * A list of **scopes** — the data the app is authorised to read or write. * An **environment** — `sandbox` (safe to experiment against seed data) or `production` (real lender data). * Optional **security controls** — IP allowlists, OAuth client credentials, tier-based rate limits. You register an app through the Developer Portal, not this API. The portal is where you generate keys, rotate them, and configure webhooks. ## Steps 1. **Sign in to the portal.** Head to your lender's Gallantree platform and open the Developer Portal from the admin menu. If your organisation is not yet enrolled as a lender, contact your Gallantree account manager. 2. **Create the app.** Give it a name that describes the integration (e.g. `"servicing-hub-sync"`), choose an environment (`sandbox` for anything you're still building), and select the scopes it needs. Scopes follow the pattern `:` — for example `loans:read`, `individuals:write`, `webhooks:manage`. You can extend the scope list later without regenerating your keys. 3. **Generate an API key.** The portal shows the full key **once**. Copy it into your secret store immediately — Gallantree only stores a hash and cannot show it again. Every key begins with the `gt_` prefix followed by a random suffix; the first 12 characters (the visible **prefix**) show up in the portal and in server logs so you can recognise which key made which call. 4. **Note the expiry.** API keys default to a 90-day expiry. The portal warns you 14 days before a key expires; you rotate by generating a second key, deploying the new one, and revoking the old one during the overlap window. See [Key rotation and expiry](/guides/key-rotation.md). ## Sandbox vs production Sandbox and production apps are separate — a key issued in one will not authenticate in the other. The portal labels every app and every key with an environment pill; make sure the label matches where you intend to make calls before you commit a key to a config vault. You can register as many apps as you need. One app per integration is a common pattern; teams sometimes split further (one app per running service) to isolate blast radius on a leaked key. ## Ready to make a call? Follow the four-step [quickstart](/getting-started/first-request.md) with the key you just generated. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://developers.gallantreecapital.com/getting-started/register-an-app.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.