Every request carries a bearer token. Keys are environment-scoped and permission-scoped, and they are rotatable without downtime because two keys can be live at once.
Authorization: Bearer cc_live_7f2a…
| Prefix | Environment | Behaviour |
|---|---|---|
| cc_test_ | Test | Fixed fixture data. Deterministic, free, safe in CI. |
| cc_live_ | Live | Real index. Metered. |
A key carries only the scopes you grant it. A repricing worker that reads offers should not hold a key that can delete memory namespaces.
| Scope | Grants |
|---|---|
| read:catalog | search, resolve, products, offers |
| read:history | history, context, forecast |
| write:watches | create and delete watches |
| write:memory | write, recall and forget memory |
| read:export | bulk exports |
Create the new key, deploy it, then revoke the old one. Both are valid in between, so rotation never requires a maintenance window. Keys are shown once at creation and stored hashed.
A key in client-side JavaScript is a public key. If you need browser access, proxy through your own backend, or issue a short-lived scoped token from your server.