Skip to main content

​
API keys

  • Keys belong to your organization, not to a person. They keep working if the teammate who created them leaves.
  • The secret starts with oak_ and is shown once at creation. Ciarem stores only a hash — nobody, including Ciarem, can recover a lost secret.
  • Send it as a bearer token on every request:

​
Plan requirement

The API is part of the Scale plan, and it is open during the free trial so you can build and test your integration before you pay. A trial key gets the whole API on a smaller budget — see rate limits. GET /v1/me tells you which one you are on: "trial": true while the trial runs. When a key is refused with 403, the detail says what fixes it:

​
Revocation

Revoke a key any time in Settings → API keys. Revocation is immediate: the next request with that secret fails with 401. Admins can create as many keys as they need — one per integration is a good habit, and each key’s last used date helps you spot the ones you can retire.

​
Good practices

  • Store secrets in your secret manager or environment variables — never in code or client-side apps.
  • The API is server-to-server: don’t call it from a browser or mobile app where the key would be exposed.
  • Rotate by creating a new key, switching your integration over, then revoking the old one.