Authentication

API keys, scopes and IP allowlists.

Send an API key as a bearer token on every /v1 request.

Bash

curl https://runner.cargoduo.com/v1/balance \
  -H "Authorization: Bearer $CARGODUO_API_KEY"

API keys

Key	Detail
Format	`cd_live_` + 40 characters
Created by	The organization owner, in the developer console
Shown	Once, at creation. Only a hash is stored
Per organization	Up to 20 active keys
Optional	Expiry date, IP allowlist (IPs or CIDR ranges)
Rotate	New secret, same settings. The old one stops at once

Keep keys on your server. Never ship one in a browser or mobile app.

Scope	Endpoints
`pack:write`	`POST /v1/pack`, `POST /v1/estimate`, `DELETE /v1/jobs/{id}`, `POST /v1/projects/{id}/pack`
`jobs:read`	`GET /v1/jobs`, `GET /v1/jobs/{id}`, `GET /v1/jobs/{id}/result`
`account:read`	`GET /v1/limits`, `GET /v1/balance`, `GET /v1/usage`
`resources:read`	`GET /v1/projects`, `GET /v1/projects/{id}`, `GET /v1/vehicles`, `GET /v1/vehicles/{id}`, `GET /v1/templates`, `GET /v1/templates/{id}`
`resources:write`	`POST /v1/projects`, `PATCH /v1/projects/{id}`, `DELETE /v1/projects/{id}`, `POST /v1/projects/{id}/pack`, `POST /v1/vehicles`, `PATCH /v1/vehicles/{id}`, `DELETE /v1/vehicles/{id}`, `POST /v1/templates`, `PATCH /v1/templates/{id}`, `DELETE /v1/templates/{id}`

New keys get every scope. POST /v1/projects/{id}/pack needs both pack:write and resources:write.

Status	Code	Meaning
401	`unauthorized`	Missing, malformed or unknown API key.
401	`key_revoked`	The key was revoked.
401	`key_expired`	The key passed its expiry date.
403	`ip_not_allowed`	The calling IP is not on the key's allowlist.
403	`subscription_inactive`	The organization has no active subscription that includes the API.
403	`account_inactive`	The organization is suspended, or has no owner whose account is active.
403	`scope_missing`	The key lacks a scope this endpoint needs.
429	`rate_limited`	Too many requests in the current minute, hour or day (per key or per organization), or more than 60 failed authentications per minute from your IP address.