Authentication
Create an API key and send it in the x-api-key header on every request.
Updated 2026-10-21
Create an API key
- In the app, open Settings > API keys.
- Choose Create key, give it a name and an optional expiry date.
- Copy the key. It is shown once; cSquare stores only a hash of it.
Keys belong to your organization, not to a person, so they keep working when people leave. Rotate them by creating a new key and revoking the old one.
Send the key
Pass the key in the x-api-key header:
bash
curl https://YOUR_API_BASE/health \
-H "x-api-key: $CSQUARE_API_KEY"A healthy response lists your tenant and the endpoints available to it:
json
{
"status": "ready",
"tenant": "Acme Platform",
"endpoints": ["GET /sub-orgs", "POST /sub-orgs", "POST /compliance/check"]
}Failure cases
| Status | Meaning |
|---|---|
401 Missing x-api-key header | The header was not sent. |
401 Invalid API key or no platform tenant configured | The key is wrong, revoked, expired, or your organization is not set up as a platform tenant. |
Keep keys safe
- Never put an API key in browser or mobile code. Call the API from your server.
- Use one key per environment so you can revoke one without affecting the others.
Get help from AI
Click Copy page for AI at the top of any API page and paste it into your assistant with a prompt like:
AI prompt
Using the cSquare GRC API docs I pasted, write a <language> function that calls the health endpoint with my API key from an environment variable and handles both 401 errors.
Was this helpful?