Auth & Token Issuance

Every request authenticates with a cn_ Bearer token.

Minting a token

1. Open /[workspaceSlug]/admin/api-tokens in the Canopy app.
2. Click New token, give it a descriptive name.
3. Choose a scope: read (GET only) or read_write (GET + POST/PATCH/DELETE).
4. Optionally set an expiry.
5. Copy the token — it begins with cn_ and is shown exactly once. Store it as a secret.

Sending the token

Pass it in the Authorization header on every request.

curl -H "Authorization: Bearer cn_xxxxxxxx" \
  https://app.canopymethod.ai/api/v1/accounts

const res = await fetch("https://app.canopymethod.ai/api/v1/accounts", {
  headers: { Authorization: `Bearer ${process.env.CANOPY_TOKEN}` },
});

import os, requests
res = requests.get(
    "https://app.canopymethod.ai/api/v1/accounts",
    headers={"Authorization": f"Bearer {os.environ['CANOPY_TOKEN']}"},
)

Scopes

A read token can only call GET endpoints. If it hits a write endpoint (POST/PATCH/DELETE) the API responds 403 with a WWW-Authenticate: Bearer scope="read_write" header. Mint a read_write token to write.

Revocation

Revoke a token from the same admin page. A revoked or expired token gets 401 with {"error":"token_revoked"} (or token_expired).

Rate limits

When you exceed the limit you get 429 with a Retry-After header and X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset. Back off and retry after Retry-After seconds.