Authentication

API Keys

The CanaryGate API uses API Keys per environment. Each environment of each project has its own key, created at:

Dashboard → Project → Environment → Settings → API Keys

Format


cg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Sending the API Key

Header (recommended)


GET /api/v1/flags
Authorization: Bearer cg_live_your_key_here

Example with fetch


const response = await fetch('https://api.canarygate.io/api/v1/flags', {
  headers: {
    Authorization: `Bearer ${process.env.CANARYGATE_KEY}`,
    'Content-Type': 'application/json'
  }
})

Example with curl


curl https://api.canarygate.io/api/v1/flags \
  -H "Authorization: Bearer cg_live_your_key_here"

Authentication errors

Status	Code	Description
`401`	`UNAUTHORIZED`	API Key missing or invalid
`403`	`FORBIDDEN`	Valid API Key but no permission for this resource


{
  "error": "UNAUTHORIZED",
  "message": "Invalid or missing API key"
}

Security

Never expose your API Key in browser code or public repositories. Use environment variables and, for browsers, only use NEXT_PUBLIC_ with keys from public environments (staging/preview).

For browser applications, consider creating a separate read-only API Key for production.