Skip to main content

Platform API Authentication

The Custodian Labs Platform API uses API key authentication.

Pass your API key in the X-API-Key header on every request:

X-API-Key: custodian_labs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

All requests go to the base URL https://platform.custodianlabs.io/v1.

Get an API Key​

API keys are generated from the Dashboard after you activate a plan.

  1. Open the Dashboard.
  2. Go to API Keys.
  3. Reveal and copy the key for your active plan.

For the full walkthrough, see Get Your API Key.

Use Environment Variables​

For local testing, store your key as an environment variable:

export CUSTODIAN_API_KEY="custodian_labs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Example Request​

Here is a chat request against a deployed Custodian app:

curl -X POST "https://platform.custodianlabs.io/v1/apps/custodian_xxxxxxxxxxxxxxxx/chat" \
  -H "X-API-Key: $CUSTODIAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "message": "What is the return policy?"
  }'

Security Guidance​

  • Do not expose your API key in browser-side code.
  • Do not commit your key to source control.
  • Do not paste real keys into public issues, screenshots, docs, or chat messages.
  • Call Custodian Labs APIs from your backend, serverless function, or secure service layer.
  • Rotate or revoke a key if it is accidentally exposed.

Common Authentication Status Codes​

StatusMeaning
401The API key is missing, invalid, inactive, or not recognized.
403The key exists but cannot be used, such as an expired key.
429The key has reached token or request limits.

For response examples, see Error Responses.

Next Steps​