Skip to main content
Keys are sent as bearer tokens. An endUserId associates sessions and memory with an application user, but client-supplied identity is not independent proof of authorization. Protect private customer APIs in your backend or connector.
Builder API keys

API key management with existing Sandbox keys redacted.

Never expose ca_live_… in browser markup, mobile bundles, logs, screenshots, or client environment variables.