Authentication

Send the API key in the Authorization header of every request:

GET /v1/me HTTP/1.1
Host: api.gocubic.io
Authorization: Bearer cubic_live_...

GET /v1/openapi.json is the only endpoint that needs no key.

Keys

• Keys start with cubic_live_.
• Create and revoke them at https://app.gocubic.io/settings/api-keys (Cubic app → Settings → API keys).
• A key is shown once, at creation. A lost key cannot be recovered; create a new one and revoke the old one.
• Read the key from the CUBIC_API_KEY environment variable. Never commit it, put it in client-side code, or send it in a query string.

Scope

One key belongs to exactly one customer account, and every response contains that account's data only. A shipment that belongs to another account returns 404 shipment_not_found.

Verify a key

GET /v1/me returns the account and key behind the request.

curl -s https://api.gocubic.io/v1/me -H "Authorization: Bearer $CUBIC_API_KEY"

{
  "account": {
    "name": "Brightwell Home Ltd"
  },
  "apiKey": {
    "name": "Inventory sync",
    "prefix": "cubic_live_9f3k",
    "createdAt": "2026-09-01T08:15:00Z"
  }
}

apiKey.prefix is the leading characters of the key and is safe to log.

A missing key returns 401 missing_api_key; an unknown or revoked key returns 401 invalid_api_key. See Errors.