Skip to content
CallMissed
Book a demo

Explore CallMissed

API keys & authentication

Create, rotate, and secure your cm_* API keys.

In this guide5 steps
  1. 1API keys start with cm_ and are shown once at creation — store them securely.
  2. 2Pass keys as Authorization: Bearer cm_xxx on the REST endpoints.
  3. 3The managed voice agent WebSocket uses Authorization: Token cm_xxx, or the ["token", "cm_xxx"] subprotocol for browsers, which cannot set headers.
  4. 4Revoke compromised keys immediately from Settings → API Keys.
  5. 5JWT tokens (dashboard login) are separate from API keys — do not expose JWTs in client apps.

  1. API keys start with cm_ and are shown once at creation — store them securely.

  2. Pass keys as Authorization: Bearer cm_xxx on the REST endpoints.

  3. The managed voice agent WebSocket uses Authorization: Token cm_xxx, or the ["token", "cm_xxx"] subprotocol for browsers, which cannot set headers.

  4. Revoke compromised keys immediately from Settings → API Keys.

  5. JWT tokens (dashboard login) are separate from API keys — do not expose JWTs in client apps.