Authentication

The public API uses API keys. Each key is scoped to one organization and carries optional scopes.

Creating a key

In the dashboard, go to Developer → API keys → Create key. The full key (ck_<prefix>_<secret>) is shown once - store it securely. Cawly only keeps a hash.

Using a key

Send it as a bearer token:

Authorization: Bearer ck_xxxxxxxx_yoursecret

Every request is automatically scoped to your organization. You cannot access another tenant's data.

Revoking

Revoke a key any time from the dashboard. Revoked keys stop working immediately.