Skip to main content
Public API v1 uses HTTP Bearer authentication with an organization API key.
or
Keys are generated server-side (cic_test_ or cic_live_ + 64 hex characters). Only the hash is stored; the full secret is shown once at creation.

Create a key (dashboard)

  1. Sign in as an org owner or admin.
  2. Open Settings → Integrations → API keys (/dashboard/settings/integrations/api-keys).
  3. Create a test or live key.
  4. Copy the secret immediately and store it in your secret manager.
Creating or listing keys requires API access on your plan. See Pricing for current plans and prices. Upgrade path in-product: /dashboard/billing/upgrade.

Rules

  • Send the full key only in the Authorization header.
  • Never put live keys in frontend JavaScript, mobile apps you ship to end users, source control, or support requests.
  • Missing / malformed header → 401 { "error": "Unauthorized", "message": "API key required in Authorization header" }.
  • Invalid, revoked, or expired key → 401 { "error": "Unauthorized", "message": "Invalid or expired API key" }.
  • Each key is scoped to one organization. Responses only include that org’s data. You do not pass orgId on public routes.
  • Every key has an explicit scope list: clients:read, clients.sensitive:read, and/or appointments:read. There is no wildcard. An empty list grants nothing. clients:read and appointments:read are the defaults; clients.sensitive:read (date of birth and gender) is off until you opt in. Creating a key requires an owner or admin who has completed MFA.

Example

OpenAPI security scheme

The published OpenAPI document defines bearerAuth (HTTP bearer, API key). Importers of /openapi.json will prompt for a token automatically.

Not supported on public v1