Authentication

Keys look like cvk_live_… or cvk_test_…. Both are real keys against real devices — the environment marker is a label to help you tell a staging integration from a production one, not a sandbox.

Send the key in the Authorization header as a bearer token. An X-API-Key header works too, if that is what your HTTP client makes easy.

GET /v1/devices HTTP/1.1
Host: api.circuvent.com
Authorization: Bearer cvk_live_your_key_here

A key is tied to the account that created it and can do nothing that account cannot. It is not able to manage keys, provision or unclaim devices, change account settings, or reach admin endpoints — those require a signed-in session. That boundary is what stops a leaked read-only key from issuing itself a broader one.

Keys never expire unless you give them an expiry, and revoking one in the console takes effect immediately. Call GET /v1/me at any time to see which account and scopes a key resolves to — it is the fastest way to debug a 403.