Skip to content
◍ cordite

Authentication

Cordite accepts bearer API keys on every /v1/* API route. Send requests from your backend or another trusted server environment.

Authorization: Bearer ck_test_...

Key prefixes:

  • ck_test_*: sandbox key for development and integration testing.
  • ck_live_*: live key for production traffic.

Store keys in your server-side secret manager. Do not expose live keys in browser code, mobile clients, logs, or public repositories.

For local integration testing, issue a test key from your local Cordite server:

Terminal window
CORDITE_DB_PATH=./cordite.dev.db cargo run -- admin issue-key --vendor "Sandbox Store" --tier free

Run the API with the same database path so the key can be authenticated:

Terminal window
CORDITE_DB_PATH=./cordite.dev.db CORDITE_RULES_DIR=./rules cargo run -- serve