Skip to main content

​
API keys

  • Keys belong to your organization, not to a person. They keep working if the teammate who created them leaves.
  • The secret starts with oak_ and is shown once at creation. Ciarem stores only a hash, so nobody, including Ciarem, can recover a lost secret.
  • Send it as a bearer token on every request:

​
Plan requirement

The API is part of the Growth and Scale plans, and it is open during the free trial so you can build and test your integration before you pay. Every plan gets the whole API; what changes is the request budget, which is largest on Scale and smallest on a trial. See rate limits. GET /v1/me tells you which one you are on: "trial": true while the trial runs. When a key is refused with 403, the detail says what fixes it:

​
Revocation

Revoke a key any time in Settings → API keys. Revocation is immediate: the next request with that secret fails with 401. Admins can create as many keys as they need. One per integration is a good habit, and each key’s last used date helps you spot the ones you can retire.

​
Good practices

  • Store secrets in your secret manager or environment variables, never in code or client-side apps.
  • The API is server-to-server: don’t call it from a browser or mobile app where the key would be exposed.
  • Rotate by creating a new key, switching your integration over, then revoking the old one.