Coming soon

Authentication

API keys authenticate every API and MCP request.

This capability is not live yet. The reference below describes how it works at launch. Join the waitlist to get Early Access.

Send your key as a Bearer token:

Authorization: Bearer ch_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Keys start with ch_live_ and are shown once at creation. We store only a SHA-256 hash.
Each key belongs to one workspace (and its default project). The workspace, plan and credits are always derived from the key, never from the request body.
Revoke a key at any time in the dashboard; requests using it fail immediately with INVALID_API_KEY.
The dashboard shows when each key was last used.
Keys are secrets: call the API from your server. Browser calls are allowed by CORS only for origins you configure.

Errors

Code	HTTP	Meaning
`UNAUTHORIZED`	401	No Authorization header.
`INVALID_API_KEY`	401	Malformed, unknown, expired or revoked key.