Authentication
How API credentials and request authentication work.
Authentication
The Cadence API authenticates every request with an API Key and API Secret pair, scoped to your account (tenant). Requests without valid credentials are rejected.
Credentials
| Header | Description |
|---|---|
X-Api-Key | Your public API key. Identifies your account. |
X-Api-Secret | Your secret key. Authenticates the request. Keep it server-side only. |
You can find and rotate these in the dashboard under Settings → API.
Example
curl -X GET \
"https://api.cadence.dev/plans/list" \
-H "X-Api-Key: {your-api-key}" \
-H "X-Api-Secret: {your-api-secret}"Security notes
- Never expose your API secret in browser code, mobile apps, or public repositories. All authenticated calls should originate from your backend.
- Rotate credentials immediately if you suspect they've leaked.
- Webhooks are signed separately — verify the
X-Segno-Signatureheader on incoming webhook requests. See Webhooks.