Authentication 

API keys belong to a workspace, not to a person. A key can read everything in its workspace, so keep it on your server. Never put it in a browser, a mobile app or a public repository.

Create a key

Create a key in your workspace's API settings. Keys start with cf_. The full key is shown once, when you create it: we store only a hash of it, so nobody can show it to you again. Put it in your secret manager or environment variables straight away.

Send the key

Send the key in the Authorization header of every request:

Authorization: Bearer cf_your_key

const res = await fetch("https://buyerhint.com/api/outreach/v1/signals?limit=100", {
  headers: { Authorization: `Bearer ${process.env.API_KEY}` },
});
const { data, next_since } = await res.json();

Revoke and rotate

Revoke a key from the same settings page. Requests with a revoked key fail with 401 straight away. To rotate without downtime, create the new key, deploy it, then revoke the old one.

When authentication fails