Skip to main content
The Developer API uses cb_live_ bearer tokens — long-lived secrets that authenticate machine-to-machine calls from your backend.
API tokens are available on every plan, including Free — no upgrade needed to start building. Actual usage is bounded by the per-token rate limits and your prepaid balance, not your tier.

​
Creating a token

  1. Open Security → API Tokens in the panel.
  2. Click Create token and give it a descriptive name (e.g. backend prod).
  3. Configure permissions and rate limits.
  4. Copy the cb_live_... secret immediately — it’s only shown once.
Lost it? Hit Regenerate to issue a new secret. The old one is immediately invalidated.

​
Permissions

Tokens lacking mcp_query get 403 on POST /api/v1/chat.

​
Rate limits

Per-token limits (configurable on creation): Rate-limit responses return 429 Too Many Requests with a Retry-After header.

​
Pass-through prefix

If you operate as a partner reselling CoreBase to multiple end-users, set a pass-through prefix on your token (e.g. acme). Audit logs then group queries by this identity, formatted as:
Each token = one stable identity. For per-end-user tracking, issue one token per end-user; the audit log lets you trace which token (and therefore which end-user) made each query. There is no inline pass-through field on the request — the identity is the token itself.

​
Security best practices

  • Never commit tokens to source control. Use environment variables and a secret manager.
  • Scope by environment. Issue separate tokens for dev / staging / prod.
  • Rotate quarterly. Regenerate tokens on a schedule even if they aren’t compromised.
  • Watch usage. Each token has its own usage chart under Tokens → [token] → Usage.

​
Revoking

Delete the token from the panel — all subsequent requests with that secret get 401. There is no soft-delete; revocation is immediate.