Skip to main content
CurbWaste authenticates partner API requests with company API keys passed as Bearer tokens. Every request to /v1/* must include a valid key in the Authorization header.
Two layers: Create API keys in the Developer Platform. Integrations call the partner API with Authorization: Bearer cw_live_… and resource scopes.

​
Getting your API key

  1. Open the Developer Platform
  2. Go to API Keys
  3. Create a key with the scopes your integration needs (for customers: customers:read and/or customers:write)
  4. Copy the cw_live_… secret once — it is only shown at creation
Store it like a password. If it leaks, revoke it in the Developer Platform and create a new key. API keys authenticate /v1 requests only — they cannot create or manage other API keys or webhooks.

​
Making authenticated requests

Example — list customers:

​
Scopes

Prefer the minimum scopes your integration needs. Additional scopes may appear in the Developer Platform when enabled for your company — see the API Reference for the full published surface.

​
What this auth is not

See Webhooks for HMAC verification.
Never put cw_live_… in frontend code or public repos. Use env vars or a secrets manager.