> For the complete documentation index, see [llms.txt](https://docs.corpdev.ai/corpdev.ai-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corpdev.ai/corpdev.ai-docs/api-access-and-authentication.md).

# API access and authentication

The public REST API allows authorized clients to work with a personal or team workspace. Access must be enabled for the intended workspace; seeing a feature in this reference does not grant access to it.

**Base URL:** `https://api.corpdev.ai/v1/public`

The examples use placeholder identifiers and an API key supplied through the environment. Run initial writes in a designated test workspace with synthetic data.

## Create and protect a key

Use the account's **API keys** controls when available. Choose the intended personal or team workspace, label the key, select the required scopes and set an expiry where offered. Copy the secret when it is created; it is shown once.

Store it in a secret store or protected runtime environment. Do not commit it, put it in client-side browser code or send it in a URL. Use the authorization header:

```http
Authorization: Bearer cdk_YOUR_SECRET_KEY
```

The key fixes the workspace. An `X-Base-Path` header is not a way to select another tenant. Use a separately authorized key for a different workspace.

## Scopes and roles

| Scope    | Purpose                                                                                  |
| -------- | ---------------------------------------------------------------------------------------- |
| `read`   | Permitted reads and supported research operations. Some of these operations use credits. |
| `write`  | Permitted mutations and generation, also subject to the key owner's role.                |
| `export` | Supported document exports.                                                              |

Scopes and workspace permissions both apply. A read key does not override restricted folders or viewer restrictions. Some collection reads require a role allowed to work with that collection. Request only the scopes your client needs.

Keys can stop working because they expire, are revoked, lose valid membership, or the workspace's API access is suspended. An enabled key is not a permanent entitlement independent of these checks.

## Suspend or revoke access

Workspace administrators can use **Workspace → API & MCP access**, when enabled, to inspect keys and suspend programmatic access. Suspension is distinct from permanent key revocation. Resume access through the available control after resolving the reason for suspension.

If the page says access is turned off by CorpDev.Ai, contact your representative; that restriction cannot be lifted by a workspace administrator alone.

Before revoking a key, identify the client using it. Replace the credential in that client if it should continue operating. A leaked key should be revoked promptly.

Continue with [REST quick start](https://docs.corpdev.ai/corpdev.ai-docs/rest-quick-start), [API behavior](https://docs.corpdev.ai/corpdev.ai-docs/errors-pagination-and-retries) and [MCP clients](https://docs.corpdev.ai/corpdev.ai-docs/connect-an-mcp-client).