Authentication

All API requests require a valid API key passed in the Authorization header.

API Keys

API keys are prefixed with chirpie_sk_ followed by a 40-character random string. They are hashed with SHA-256 before storage — we never store your raw key.

Authorization: Bearer chirpie_sk_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789ab

Getting Your Key

From the Dashboard

Go to chirpie.ai/dashboard/keys
Click Create Key
Give it a name (e.g., "Production", "My Bot")
Copy the key immediately — it won't be shown again

From the CLI

chirpie login          # Opens browser, creates key automatically
chirpie keys create    # Create additional keys

From the API

# Requires an existing key to create a new one
curl -X POST https://chirpie.ai/api/v1/keys \
  -H "Authorization: Bearer chirpie_sk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "My New Key" }'

Key Management

Action	Endpoint
Create	`POST /api/v1/keys`
List	`GET /api/v1/keys`
Revoke	`DELETE /api/v1/keys?id=KEY_ID`

You can have up to 25 API keys per account. Revoked keys immediately stop working.

Security Best Practices

Never commit keys to version control
Use environment variables — CHIRPIE_API_KEY for CLI/MCP
Rotate keys regularly — create a new key, update your app, revoke the old one
Don't share keys — create separate keys for each service or team member
Never use keys in client-side code — API keys in browser JavaScript are visible to anyone