Authentication

CastBrick uses API keys for server-to-server authentication.

Using the API key

Include the API key in the Authorization header as a Bearer token:

Authorization: Bearer YOUR_API_KEY

Keep keys secret and rotate them periodically. Use distinct keys for different environments (dev/staging/production) and limited-permission keys for webhooks or temporary tasks.

Scopes and permissions

API keys may carry scopes like send:email, send:sms, templates:read, templates:write. When creating a key in the dashboard, select the minimal scopes required.