Keys begin with co_live_. Send your API key in the Authorization header on each request.
curl "$CHARTEROPS_API_URL/v1/operators" \
--header "Authorization: Bearer $CHARTEROPS_API_KEY"Organization and scopes
A key belongs to one organization. The server determines that organization from the credential; a client cannot select another tenant by supplying an organization ID. Keys carry read and write scopes. The API reference lists every operation a key can call and the scope each one needs. Routes for signing in, members and billing are reserved for signed-in people.
Dashboard sign-in uses short-lived access tokens and rotating refresh tokens. Those credentials are separate from the keys intended for server integrations.
API-key access requires an active paid subscription or an explicit administrator grant of complimentary access for the organization. Signing in or selecting a plan does not activate keys.
Keep the secret private
Use a secret store or server environment variable. Never put a key in browser code, screenshots, analytics, public repositories or query strings. The server stores a hash of the secret. The full key is returned only when it is created.
If a key is lost or exposed, revoke it and create a replacement. Revocation takes effect for subsequent requests. Never retry key creation expecting the original secret to be displayed again.
Access failures
A missing or invalid credential returns 401. Insufficient scope or a person-only operation returns 403. Changing a record ID cannot grant access to another organization’s records. Read the structured error response before deciding whether to retry.