> ## Documentation Index
> Fetch the complete documentation index at: https://docs.capibo.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests with an API key.

All requests use an API key, sent as a bearer token:

```bash theme={null}
curl https://api.capibo.work/v1/missions \
  -H "Authorization: Bearer cpb_live_..."
```

Requests without a valid key return `401` with `api_key_invalid`. Keys belong to your organization, not to a person, so they keep working when teammates leave.

## Live and test keys

| Prefix | Use for | Behavior |
| - | - | - |
| `cpb_live_` | Production | Real missions, real collectors and real charges. |
| `cpb_test_` | Development and CI | Same API surface. Missions are never dispatched, no credits are spent, and datasets return sample videos. |

## Scopes

Pick a scope when you create the key in **Settings → API keys**:

| Scope | Can |
| - | - |
| **Read only** | Read missions, datasets, videos, usage and billing. |
| **Read datasets** | Read datasets, videos and exports only. A good fit for training pipelines. |
| **Full access** | Everything, including creating missions, exports, webhooks and redeeming promo codes. |

A request outside the key's scope returns `403` with `permission_denied`.

## Keeping keys safe

> [!WARNING]
>
> Never ship an API key in client-side code or a mobile app. Call the API from your backend, notebooks or training infrastructure only.

* Store keys in a secret manager or environment variables, not in source control.
* Use a separate key per system, so you can revoke one without breaking the others. The platform shows when each key was last used.
* If a key leaks, revoke it in **Settings → API keys**. Revocation takes effect immediately.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.