Authentication

Send a secret API key in the Authorization header:

curl https://app.cueston.com/api/workspaces/current \
  -H "Authorization: Bearer sk_…"

Create a key

In the dashboard, open Settings → API keys and create a key. Copy it: the secret is shown once. Keep it in your server's environment or your CI's secret store, never in source code or a browser.

What a key can do

A key acts as the person who created it, with their current role in the workspace it was created in. If their role changes, so does what the key can do. If they leave the workspace, the key stops working. Each endpoint in the reference lists the permission it needs; without it the answer is 403 forbidden.

Some account actions never accept a key, even an owner's: changing passwords, managing API keys, billing, single sign-on and SCIM settings, identity verification settings and rotating publishable keys. They need the dashboard.

Keep keys safe

• Keys in a URL query string are refused (400), because URLs end up in logs and browser history.
• Revoke a key in Settings → API keys as soon as you don't need it, or if it may have leaked. People with "See and revoke every member's API keys" can revoke anyone's.
• Every change made with a key is in the audit log with the key as the actor.

Other credentials