Authentication
Every Storage API request is authenticated with the secret half of a key pair.
The header
Authorization: Bearer cbs_your_secret_hereA key pair is a public key ID (cbk_…) and a secret (cbs_…). Only a
SHA-256 hash of the secret is stored — we can't show it again after it's revealed, so save it when you generate it.
Generate, reveal, roll, revoke
Manage keys yourself in your dashboard → API keys, or on the developer portal:
- Auto-issued — your first key is created at sign-up, waiting to be revealed.
- Reveal — shows the secret once, then wipes it.
- Roll — issues a new secret; the old one stops working immediately.
- Revoke — disables the key for good.
Test vs. live
Keys come in two modes:
| Mode | Prefix | Behaviour |
|---|---|---|
| Live | cbk_… / cbs_… | Reads and writes your real storage; counts against your plan. |
| Test | cbk_test_… / cbs_test_… | Writes to an isolated sandbox; quota-free; never mixed with live data. |
Scopes
Each key carries one or more scopes: read, write, delete. A call needs
the matching scope or it returns 403. See Errors & limits.