cicora.ai
English
API specificationSecurity

Authentication

Send an API key in a Bearer header and keep production credentials separate from development credentials.

Integration reference: choose parameters and available capabilities from your account API settings and the model catalogue for your environment.

Send the key in a header

Every protected request uses the Authorization header with the Bearer scheme. Never put a key in query parameters, URLs, error messages, or analytics events.

Reading the model catalogue is a useful first check because it does not create user content.

Authorization header
bash
curl --request GET https://cicora.ai/api/v1/models \
  --header "Authorization: Bearer $CICORA_API_KEY" \
  --header 'Accept: application/json'

Key management practice

  • Use a different key for each application and environment.
  • Grant only the access you need and rotate a key when exposure is suspected.
  • Redact Authorization completely before emitting HTTP logs.

Client and server boundary

A browser, mobile app, and public website should call your server-side broker whenever the key cannot be stored safely on the device.

Associate a key with an internal owner and trace id so you can investigate failures without exposing a secret.

Continue with