Authentication

REST API requests carry an API key. Hosted MCP also supports browser sign-in with OAuth. The API lives at:

https://api.cedr.dev/v1

API Keys

Keys are personal: each one acts as the person who created it, with access to every organization they belong to. Two-factor sign-in does not apply to keys, so treat a key like a password.

• Create keys on the API Keys page in the app. Free accounts can hold 3 at a time, Pro and Team 25, and Business 50. Your keys follow the best plan among the organizations you belong to.
• Every key starts with cedr_. The full key is shown once, when you create it; afterwards the app shows only its first characters.
• Choose an expiry of 30, 90 or 365 days, or a key that never expires. An expired key stops working at once and is marked Expired in the list.

Restricting a Key

Restrictions are set when you create a key and shown in the list. To change them, create a new key and revoke the old one.

• Read only: the key can make REST GET and HEAD requests and call MCP read tools over POST. Recording MCP verdicts requires write access.
• Allowed IP addresses: up to 20 addresses or CIDR ranges, such as 203.0.113.7 or 198.51.100.0/24. Requests from anywhere else are refused. A key keeps its allowlist if your plan changes.

Tip

Create one key per machine, pipeline or agent. Then you can revoke one without touching the others, and Logs shows which one made each request.

Sending a Key

Send the key as a Bearer token:

curl https://api.cedr.dev/v1/me -H "Authorization: Bearer $CEDR_API_KEY"

For tools that cannot set Authorization, an X-API-Key: <key> header also works. Never put a key in a URL: URLs end up in logs and browser history.

When a Key Is Refused

The API answers 401 Unauthorized with a JSON body and a WWW-Authenticate: Bearer header:

error	Meaning
missing_api_key	No key was sent, or the Authorization header is not Bearer <key>.
invalid_api_key	The key is mistyped, expired or revoked.

A restricted key used outside its limits gets 403 Forbidden with ip_not_allowed or insufficient_scope.

See Errors for every error the API returns.

Rotating a Key

1. Create a new key and deploy it wherever the old one runs.
2. Check the old key’s Last used time on the API Keys page stops moving.
3. Select Revoke on the old key. Revoking takes effect on the next request.

If a key leaks, revoke it first and replace it after.