API keys

API keys are the simplest way to connect your own backend, script, or data workflow.

Create a key

1. In Infinite Audience, open Account → Partnerships.
2. Create a key, give it a recognizable name, and choose the scopes it needs.
3. Copy the key when it appears and store it in your secret manager.

Only organization owners and admins can create or revoke keys. The full key is shown once; if it is lost, revoke it and create another.

Exchange the key

An API key beginning with cf_live_ is exchanged for a one-hour bearer token:

curl -X POST https://api.infiniteaudience.ai/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"api_key":"cf_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"}'

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Use the returned token—not the raw key—on API requests:

curl https://api.infiniteaudience.ai/v1/catalog/fields \
  -H "Authorization: Bearer eyJhbGciOi..."

Let the SDK do the housekeeping

Our Python and npm libraries exchange and renew tokens for you. If you call the API directly, exchange the key again shortly before the current token expires.

The same exchange token can be sent to MCP or A2A by a service you operate, subject to the key’s scopes. Ask your token manager for a current bearer before each request, including A2A status polls. Re-exchange the key shortly before the one-hour bearer expires; API-key exchange does not return an OAuth refresh token. Interactive MCP and A2A clients should use OAuth so people can sign in and revoke the connection without sharing a key.

Revoke a key

Open Account → Partnerships and deactivate the key, or call DELETE /v1/settings/api-keys/{id}. Previously issued access tokens may remain valid for up to one hour, so rotate deliberately.