Authentication

Send the API key in the Authorization header: Bearer cx_test_… or Bearer cx_live_…. Keep keys on your server. The dashboard shows the full secret once and stores only a SHA-256 hash.

Revoke a key from the dashboard. Revoked keys fail authentication. Do not put secret keys in browser code.