Skip to main content
The Culper API uses campaign-scoped bearer tokens (similar to the Supabase CLI or a GitHub personal access token). One key = one campaign, read-only.

​
Getting a key

Manage keys yourself in the campaign dashboard under Settings → API — create, view, and revoke campaign-scoped keys there. The API is in private beta: if you don’t see the tab, it isn’t enabled for your campaign yet — contact the Culper team to turn it on.
A key looks like this and is shown once at creation — store it somewhere safe (the example below is a placeholder, not a real key):
We store only a hash of your key, never the key itself. If it leaks, we revoke it and issue a new one — the old key stops working immediately.

​
Using your key

Send it as a bearer token on every request:

​
Scopes

Each key carries a set of read scopes. Requesting an endpoint your key doesn’t have a scope for returns 403 forbidden.
Keep your key secret. It grants read access to your whole campaign’s data for its scopes. Never embed it in a mobile app, browser, or public repo — call the API from a server you control.