An API Key is a credential that lets other programs act on behalf of your Organization A workspace in CloudCannon that groups together Sites, team members, and shared resources. It is also the unit CloudCannon bills for. You can define permissions for your Organization, controlling the access each team member has to resources on CloudCannon. You can create and be a part of multiple Organizations. An API (Application Programming Interface) is a set of methods and rules that allow one piece of software to interact with another using code to call specific functions for reading data, triggering actions, or responding to events, rather than a graphical interface. A typed client library for the CloudCannon API that handles authentication and request signing, letting programs read and change content in your Organization without a person logging in through a browser. The CloudCannon SDK (Software Development Kit) authenticates with an Access Key or an API Key, and the CloudCannon CLI is built on top of it.Organization
API
SDK
An API Key belongs to a single Organization, not to your personal account. CloudCannon shows the key only once, at the moment you create it.
Unlike an Access Key, which inherits your full account access, an API Key is scoped to the permissions you choose when you create it. This lets you grant a program only the access it needs. For example, you can create a key that reads content but cannot publish it.
How programs use an API Key#
When you create an API Key, CloudCannon shows the key once. You store it somewhere safe, such as a password manager or a secret manager, and give it to the program that needs it. From then on, the program sends the key with each request it makes to the CloudCannon API, and CloudCannon checks the key and its permissions before allowing the request.
The CloudCannon SDK is the most direct way to use an API Key. The SDK is a typed client for the CloudCannon API that handles authentication and request signing for you. You can also use an API Key with the CloudCannon API directly, or with the CloudCannon CLI by setting the CLOUDCANNON_API_KEY environment variable.
To target your Organization through the API or SDK, you also need your Organization UUID, which appears on the API Keys page alongside your keys.
Permissions and security#
By default, only members of the Owners Permission Group can create and delete API Keys. You can grant creation to a Custom Permission Group with the org:api-key:create permission, but only Owners can delete a key.
Because an API Key can act on behalf of your Organization, treat it like a password. Store it securely, never commit it to source control, and never expose it in browser or client-side code. Create a separate key for each program so you can delete one without affecting the others.
An API Key does not expire on its own. It remains valid until you delete it from the API Keys page. When you delete a key, CloudCannon rejects any request made with it.