> ## Documentation Index
> Fetch the complete documentation index at: https://docs.curbwaste.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CurbWaste API Authentication: API Keys and Bearer Tokens

> CurbWaste uses company API keys with Bearer token authentication. Learn how to create your key in the Developer Platform, set required scopes, and handle auth errors.

CurbWaste authenticates **partner** API requests with company API keys passed as Bearer tokens. Every request to `/v1/*` must include a valid key in the `Authorization` header.

<Note>
  **Two layers:** Create API keys in the [Developer Platform](https://platform.curbwaste.com). Integrations call the partner API with `Authorization: Bearer cw_live_…` and resource scopes.
</Note>

## Getting your API key

1. Open the [Developer Platform](https://platform.curbwaste.com)
2. Go to **API Keys**
3. Create a key with the scopes your integration needs (for customers: `customers:read` and/or `customers:write`)
4. Copy the `cw_live_…` secret once — it is only shown at creation

```text theme={null}
cw_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

Store it like a password. If it leaks, revoke it in the Developer Platform and create a new key.

API keys authenticate `/v1` requests only — they cannot create or manage other API keys or webhooks.

## Making authenticated requests

```bash theme={null}
Authorization: Bearer cw_live_YOUR_API_KEY
```

Example — list customers:

```bash theme={null}
curl "https://api.curbwaste.com/v1/customers" \
  -H "Authorization: Bearer cw_live_YOUR_API_KEY"
```

| Status | Meaning |
| - | - |
| `401` | Missing or invalid API key |
| `403` | Key is valid but missing the required scope |

## Scopes

| Scope | Allows |
| - | - |
| `customers:read` | `GET /v1/customers`, `GET /v1/customers/{id}` |
| `customers:write` | `POST` and `PATCH` customers |

Prefer the minimum scopes your integration needs. Additional scopes may appear in the Developer Platform when enabled for your company — see the [API Reference](/api-reference/overview) for the full published surface.

## What this auth is *not*

| Concern | Auth model |
| - | - |
| REST (`/v1/...`) | Bearer API key + scopes |
| Key and webhook management | Developer Platform UI at [platform.curbwaste.com](https://platform.curbwaste.com) |
| Outbound webhooks to *your* URL | HMAC (`X-CurbWaste-Signature`) — not the API key |

See [Webhooks](/concepts/webhooks) for HMAC verification.

<Tip>
  Never put `cw_live_…` in frontend code or public repos. Use env vars or a secrets manager.
</Tip>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.