Authentication

All API endpoints require authentication unless explicitly marked as public.

API Key Authentication

Include your API key in the X-API-Key header:

curl -H "X-API-Key: csb_AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEf_1a2b3c4d" \
  https://www.closient.com/products/api/v1/products

Key Format

<prefix>_<body>_<checksum>

Component	Description
`prefix`	Key type identifier (`csb`, `csu`, or `cpk`)
`body`	32 random alphanumeric characters
`checksum`	8-character lowercase hex CRC-32 digest of the body

The checksum enables client-side format validation before making a request:

import zlib

def verify_api_key(api_key: str) -> bool:
    parts = api_key.split("_")
    if len(parts) != 3:
        return False
    prefix, body, checksum = parts
    if prefix not in ("csb", "csu", "cpk"):
        return False
    expected = format(zlib.crc32(body.encode("utf-8")) & 0xFFFFFFFF, "08x")
    return checksum == expected

Key Types

Prefix	Name	Scope	Use Case
`csb`	Business	Organization	Server-side API access with full permissions
`csu`	User	User	User-scoped access, respects the user’s org memberships
`cpk`	Publishable	Organization	Client-side widgets and embeds — safe to expose in frontend code

Publishable keys (cpk) differ from the other types in that they are:

Scoped to a single organization (returns org context, not user context)
Limited to a lower default rate (100 requests/minute) suited to client-side use

Per-key rate limits (rate_limit_per_minute, rate_limit_per_day) and optional expiration (expires_at) apply to every key type, not just publishable ones — see Rate Limits.

Key Lifecycle

Keys are shown once at creation time. The raw key is never stored — only its SHA-256 hash.

Field	Description
`is_active`	Set to `false` to immediately revoke
`expires_at`	Optional expiration datetime (rejected after expiry)
`last_used`	Updated on each authenticated request
`rate_limit_per_minute`	Per-key override (0 = use global default)
`rate_limit_per_day`	Per-key override (0 = use global default)

Organization Roles (RBAC)

Users belong to organizations through memberships, each with a role:

Role	Manage Org	Billing	Members	Offers	API Keys
Owner	Yes	Yes	Yes	Yes	Yes
Manager	No	Yes	Yes	Yes	Yes
Billing	No	Yes	No	No	No
Editor	No	No	No	Yes	No

Roles are evaluated per-organization. A user can be an Owner of one organization and an Editor of another.

Permission Reference

Permission	Required Role	Reachable with an API key?
`organization.view_organization`	Any member	Yes
`organization.contribute_organization`	Owner, Manager, or Editor	Yes — key role `editor` or `manager`
`organization.change_organization`	Owner or Manager	Yes — key role `manager`
`organization.manage_offers`	Owner, Manager, or Editor	Yes — key role `editor` or `manager`
`organization.manage_billing`	Owner, Manager, or Billing	No
`organization.manage_api_keys`	Owner or Manager	No
`organization.manage_members`	Owner or Manager	No
`organization.manage_organization`	Owner only	No
`organization.delete_organization`	Owner only	No

The five permissions marked No are reachable only from a signed-in browser session. An API key is refused with 403 even when the person who created it holds the role — deleting an organization, changing who belongs to it, moving money, and minting further keys all require a human at a keyboard.This is a property of the credential, not of the person: it applies to keys created by owners and by staff alike, and to OAuth bearer tokens. It exists so that a leaked key is bounded by what a key can do, rather than by whoever happened to create it. Automate these five against the Dashboard instead.

Session Authentication

Browser-based access (Dashboard, admin) uses Django session cookies. This is automatic when logged in and is primarily for internal use. API integrations should always use API key authentication.

Security Best Practices

Never expose csb or csu keys in client-side code — use cpk publishable keys instead
Store keys in environment variables, not in source code
Rotate keys periodically and revoke unused ones
Use per-key rate limits on publishable keys to prevent abuse
Set expiration dates on keys used for temporary integrations

Getting Started

Developer Questions

User Guides

Technical Guides

MCP Server

Agent Skills

Compliance

Concepts

API Reference

Resources

API Key Authentication

Key Format

Key Types

Key Lifecycle

Organization Roles (RBAC)

Permission Reference

Session Authentication

Security Best Practices

​API Key Authentication

​Key Format

​Key Types

​Key Lifecycle

​Organization Roles (RBAC)

​Permission Reference

​Session Authentication

​Security Best Practices

API Key Authentication

Key Format

Key Types

Key Lifecycle

Organization Roles (RBAC)

Permission Reference

Session Authentication

Security Best Practices