Authentication

The Cedius API uses secret API keys.

Include a key as a bearer token:

Authorization: Bearer YOUR_API_KEY

Portfolio note: The credentials shown here are examples and do not authenticate against a live service.

Key types

Test keys

cedius_test_sk_...

Use test keys while developing or validating an integration.

Live keys

cedius_live_sk_...

In a real deployment, live keys would provide access to production business data and must be treated as secrets.

Protect your key

Do not:

• commit a key to Git;
• place a secret key in frontend JavaScript;
• include it in screenshots;
• share it in support messages;
• embed it in a public web or mobile application.

Store secrets in environment variables or a secret manager.

export CEDIUS_API_KEY="cedius_test_sk_example"

Missing or invalid credentials

401 Unauthorized

{
  "error": {
    "code": "authentication_failed",
    "message": "A valid API key is required.",
    "request_id": "req_71fa2c"
  }
}

Authentication vs authorization

Authentication identifies the caller. Authorization determines what the caller may do.

Cedius uses:

• owner
• manager
• staff

A valid caller without permission receives 403 Forbidden.

See Permissions.