# Authentication

> Bearer API keys. One key belongs to one customer account.

Send the API key in the `Authorization` header of every request:

```http
GET /v1/me HTTP/1.1
Host: api.gocubic.io
Authorization: Bearer cubic_live_...
```

`GET /v1/openapi.json` is the only endpoint that needs no key.

## Keys

- Keys start with `cubic_live_`.
- Create and revoke them at [https://app.gocubic.io/settings/api-keys](https://app.gocubic.io/settings/api-keys) (Cubic app → **Settings → API keys**).
- A key is shown once, at creation. A lost key cannot be recovered; create a new one and revoke the old one.
- Read the key from the `CUBIC_API_KEY` environment variable. Never commit it, put it in client-side code, or send it in a query string.

## Scope

One key belongs to exactly one customer account, and every response contains that account's data only. A shipment that belongs to another account returns `404 shipment_not_found`.

## Verify a key

`GET /v1/me` returns the account and key behind the request.

```bash
curl -s https://api.gocubic.io/v1/me -H "Authorization: Bearer $CUBIC_API_KEY"
```

```json
{
  "account": {
    "name": "Brightwell Home Ltd"
  },
  "apiKey": {
    "name": "Inventory sync",
    "prefix": "cubic_live_9f3k",
    "createdAt": "2026-09-01T08:15:00Z"
  }
}
```

`apiKey.prefix` is the leading characters of the key and is safe to log.

A missing key returns `401 missing_api_key`; an unknown or revoked key returns `401 invalid_api_key`. See [Errors](https://developers.gocubic.io/errors.md).