API keys & authentication

1. API keys start with cm_ and are shown once at creation — store them securely.
2. Pass keys as Authorization: Bearer cm_xxx on all /v1/* endpoints.
3. Revoke compromised keys immediately from Settings → API Keys.
4. JWT tokens (dashboard login) are separate from API keys — do not expose JWTs in client apps.

← Back to Help Center