CartrouteHow does Cartroute API authentication work?
Every metered and account endpoint needs an API key sent as Authorization: Bearer cr_live_... (or as an X-API-Key header). Keys are created in the dashboard or by POST /api/v1/accounts, are shown once, and are never accepted in the URL.
How do I send the key?
curl "https://cart-route.com/api/v1/account" -H "Authorization: Bearer $CARTROUTE_API_KEY" # equivalent curl "https://cart-route.com/api/v1/account" -H "X-API-Key: $CARTROUTE_API_KEY"
A key in a query string is ignored on purpose: URLs are written to proxy, browser and server logs, so a key placed there should be treated as leaked.
What does a key look like?
cr_live_ followed by 40 URL-safe characters. The dashboard shows only the first 16 characters afterwards (for example cr_live_8fJ2kQ1a…) so you can tell keys apart.
How are keys stored?
Cartroute keeps only a SHA-256 hash of each key. A lost key cannot be recovered or displayed again; revoke it and create a new one.
How many keys can an account have?
Ten active keys. Use one per environment or per agent so a leak can be revoked without downtime elsewhere, and so the dashboard shows usage per key.
How do I rotate a key?
- Create a new key in the dashboard.
- Deploy it to the agent or service.
- Watch the old key's Last used time stop moving.
- Revoke the old key. Requests using it immediately return
401 unauthorized.
What does an authentication failure return?
401 with code: "unauthorized" when the key is missing, malformed or revoked, and 403 with code: "account_suspended" when the account has been suspended. Neither is charged. See errors.
Which endpoints need no key?
GET /api/v1, /retailers, /categories, POST /accounts, the MCP discovery methods (initialize, tools/list, resources/*, prompts/*) and every public web page, including its JSON form.
Is CORS enabled?
Yes, for every origin. The API authenticates with keys, never cookies, so cross-origin calls carry no ambient credentials. Do not ship a key in public browser code: anyone can read it. Call the API from your server or agent runtime.