Authentication

All API endpoints require authentication unless explicitly marked as public.

API Key Authentication

Include your API key in the X-API-Key header:

curl -H "X-API-Key: csb_AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEf_1a2b3c4d" \
  https://www.closient.com/products/api/v1/products

Key Format

<prefix>_<body>_<checksum>

Component	Description
`prefix`	Key type identifier (`csb` or `cpk`)
`body`	32 random alphanumeric characters
`checksum`	8-character lowercase hex CRC-32 digest of the body

The checksum enables client-side format validation before making a request:

import zlib

def verify_api_key(api_key: str) -> bool:
    parts = api_key.split("_")
    if len(parts) != 3:
        return False
    prefix, body, checksum = parts
    if prefix not in ("csb", "cpk"):
        return False
    expected = format(zlib.crc32(body.encode("utf-8")) & 0xFFFFFFFF, "08x")
    return checksum == expected

Key Types

Prefix	Name	Scope	Use Case
`csb`	Business	Organization	Server-side API access at the key’s role
`cpk`	Publishable	Organization	Client-side widgets and embeds — safe to expose in frontend code

Every key belongs to exactly one organization and acts only on that organization, at the role it was given when it was minted. The person who created the key is recorded for the audit trail; their other memberships never extend the key’s reach, and a key created by an Owner is not an Owner. To act on two organizations you need two keys. Publishable keys (cpk) differ from the other types in that they are:

Scoped to a single organization (returns org context, not user context)
Limited to a lower default rate (100 requests/minute) suited to client-side use

Per-key rate limits (rate_limit_per_minute, rate_limit_per_day) and optional expiration (expires_at) apply to every key type, not just publishable ones — see Rate Limits.

Key Lifecycle

Keys are shown once at creation time. The raw key is never stored — only its SHA-256 hash.

Field	Description
`is_active`	Set to `false` to immediately revoke
`expires_at`	Optional expiration datetime (rejected after expiry)
`last_used`	Updated on each authenticated request
`rate_limit_per_minute`	Per-key override (0 = use global default)
`rate_limit_per_day`	Per-key override (0 = use global default)

Organization Roles (RBAC)

Users belong to organizations through memberships, each with a role:

Role	Manage Org	Billing	Members	Offers	API Keys
Owner	Yes	Yes	Yes	Yes	Yes
Manager	No	Yes	Yes	Yes	Yes
Billing	No	Yes	No	No	No
Editor	No	No	No	Yes	No

Roles are evaluated per-organization. A user can be an Owner of one organization and an Editor of another. An API key has its own role (manager, editor or readonly), evaluated the same way but only ever on the key’s own organization. A readonly key minted by an Owner can read that organization and nothing more.

Permission Reference

Permission	Required Role	Reachable with an API key?
`organization.view_organization`	Any member	Yes — any key role, on the key’s organization
`organization.contribute_organization`	Owner, Manager, or Editor	Yes — key role `editor` or `manager`, on the key’s organization
`organization.change_organization`	Owner or Manager	Yes — key role `manager`, on the key’s organization
`organization.manage_offers`	Owner, Manager, or Editor	Yes — key role `editor` or `manager`, on the key’s organization
`organization.manage_billing`	Owner, Manager, or Billing	No
`organization.manage_api_keys`	Owner or Manager	No
`organization.manage_members`	Owner or Manager	No
`organization.manage_organization`	Owner only	No
`organization.tombstone_organization`	Owner, or an owner-issued Manager-role key	Yes — key role `manager`, on the key’s own organization, and minted by a current owner of it
`organization.delete_organization`	Owner only	No

organization.tombstone_organization gates DELETE /organizations/{id} itself — the reversible 90-day tombstone (C-6197). organization.delete_organization is the narrower, still fully human-only permission behind the truly irreversible operations: fast-purge and restore.

The four permissions marked No are reachable only from a signed-in browser session. An API key is refused with 403 even when the person who created it holds the role — changing who belongs to an organization, moving money, minting further keys, and the operations that follow a tombstone (fast-purge, restore) all require a human at a keyboard.This is a property of the credential, not of the person: it applies to keys created by owners and by staff alike, and to OAuth bearer tokens. It exists so that a leaked key is bounded by what a key can do, rather than by whoever happened to create it. Automate these five against the Dashboard instead.

Session Authentication

Browser-based access (Dashboard, admin) uses Django session cookies. This is automatic when logged in and is primarily for internal use. API integrations should always use API key authentication.

Security Best Practices

Never expose csb keys in client-side code — use cpk publishable keys instead
Store keys in environment variables, not in source code
Rotate keys periodically and revoke unused ones
Use per-key rate limits on publishable keys to prevent abuse
Set expiration dates on keys used for temporary integrations

Getting Started

Developer Questions

User Guides

Technical Guides

MCP Server

Agent Skills

Compliance

Concepts

API Reference

Resources

API Key Authentication

Key Format

Key Types

Key Lifecycle

Organization Roles (RBAC)

Permission Reference

Session Authentication

Security Best Practices

​API Key Authentication

​Key Format

​Key Types

​Key Lifecycle

​Organization Roles (RBAC)

​Permission Reference

​Session Authentication

​Security Best Practices

API Key Authentication

Key Format

Key Types

Key Lifecycle

Organization Roles (RBAC)

Permission Reference

Session Authentication

Security Best Practices