AUTHENTICATION
Use API keys for REST and custom MCP clients.
REST is API-key authenticated. API keys begin with cp_test_ or cp_live_; custom MCP clients may use the same bearer keys. Send keys only from a trusted system, store them in a secrets manager and rotate or revoke them from the account console. The full token is displayed only once.
Recommended header
Authorization: Bearer cp_live_…Token is accepted for compatibility, but new API-key integrations should use Bearer. Never put a key in browser JavaScript, a URL, logs, a public repository or ChatGPT. ChatGPT MCP connections use OAuth instead.
