Skip to main content

​
Bearer Tokens

Every request must send an API key in the Authorization header:
Cortado API keys always begin with cort_. Create one from Settings > Integrations > API Keys — see the API Keys guide.
Keys are secrets. Keep them on a server or in your automation tool’s secrets storage — never in a website, browser extension, or mobile app, where anyone can read them.

​
Authentication Failures

A revoked key stops working immediately. If API access is turned off for your organization, existing keys are not deleted — they start returning 403 and work again if access is restored.

​
Scope

A key can only read data in the organization it was created in. Requesting a record that belongs to a different organization returns 404 not_found, the same response as a record that doesn’t exist — the API never reveals whether another business’s record exists.

​
Rate Limits

Each key may make 600 requests per minute. Beyond that, requests return 429 with a Retry-After: 60 header.
Cache what you fetch and avoid re-requesting the same record in a tight loop. If you do hit the limit, wait the number of seconds in Retry-After before retrying rather than retrying immediately.

​
Usage Tracking

Cortado records the last time each key was used and shows it in the keys table under Last used. It updates at most once per minute, so a burst of requests shows a single recent timestamp rather than every call.

​
Rotating a Key

There is no way to change an existing key’s secret. To rotate:
1

Create a new key

Create a second key and copy its secret.
2

Update your tool

Point the integration at the new key and confirm it works.
3

Revoke the old key

Revoke the previous key from the keys table.