Authentication

The public API uses project API keys. Each key can access one project only.

Issue a key

1. Sign in to Cronbolt.
2. Open Settings.
3. Select the project the key should manage.
4. Choose Create API key.
5. Copy the key before closing the dialog.

Cronbolt stores only a hash. The full key cannot be shown again.

Send the key

Agents must read the key from the exact CRONBOLT_API_KEY variable in their process environment. If it is missing or empty, stop and ask the developer to configure it in the agent's secret environment. Never ask for the key in a conversation or search source files and logs for it.

Add the key to every public API request:

X-API-Key: cbk_your_project_api_key

curl --fail-with-body -sS "https://api.cronbolt.com/api/v1/context" \
  -H "X-API-Key: $CRONBOLT_API_KEY"

Do not put the key in a URL or request body.

Scope

A project key can:

• Check its own project context and plan limits.
• Create and manage jobs in its own project.
• Read run history for those jobs.

A project key cannot:

• Access another project.
• Create projects or API keys.
• Read account details.
• Start checkout or manage billing.

Browser authentication, project administration, and billing use internal app endpoints. They are not part of the public API or public OpenAPI schema.

Revoke a key

Open Settings, find the key by name or prefix, and choose Revoke. Requests using that key stop working immediately.