Authentication

All API requests require an Authorization header with a Bearer token (API key). Each account can generate multiple named keys, see when they were last used, and revoke them at any time.

Header format

Authorization: Bearer cbct_live_a3f9b1c2d4e5f6g7h8i9j0k1l2m3n4o5

How to create an API key

1. Sign up at cbcthub.com/signup (Free plan available).
2. In the dashboard, open Settings → API.
3. Give it a descriptive name (e.g. “Internal clinic system”) and click Create key.
4. The key is shown ONLY ONCE. Copy it and store it in your secret manager (environment variables, AWS Secrets Manager, Vault, Doppler).

Permissions by scope

Each key has scopes that determine what it can do. Today keys are created with both scopes enabled:

• exams:read — list and read exams
• exams:write — create, confirm and delete exams

Revoking keys

From Settings → API you can revoke any key. Revocation is immediate: subsequent calls return 401. Revoked keys stay listed for audit purposes but cannot be reactivated.

What happens with an invalid key

If the key is missing, malformed, invalid or revoked, you get a 401 unauthorized:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or revoked API key."
  }
}