Authentication

API keys

Every request to the CueAPI (except health, status, and auth endpoints) requires a Bearer token:

Authorization: Bearer cue_sk_YOUR_API_KEY

API keys start with cue_sk_ followed by 32 hex characters.

Getting an API key

How auth works

1. Your API key is sent as a Bearer token in the Authorization header
2. CueAPI hashes it with SHA-256 and checks against a Redis cache (5-minute TTL)
3. On cache miss, it falls back to a PostgreSQL lookup
4. If valid, the request proceeds with your user context (plan, limits, etc.)

Key management

Check your current key

cueapi whoami

Or via API:

curl https://api.cueapi.ai/v1/auth/me \
  -H "Authorization: Bearer cue_sk_YOUR_KEY"

Regenerate your key

If your key is compromised, regenerate it immediately:

cueapi key regenerate

Credential resolution order

The CLI and worker resolve API keys in this order:

1. --api-key flag (CLI) or api_key in config (worker)
2. CUEAPI_API_KEY environment variable
3. ~/.config/cueapi/credentials.json (saved by cueapi login)

Credential storage

Credentials are stored at:

The file has 600 permissions (owner read/write only) and supports multiple profiles:

{
  "default": {
    "api_key": "cue_sk_...",
    "email": "you@example.com",
    "api_base": "https://api.cueapi.ai"
  }
}