Guide

Authentication

Every call carries a workspace API token in the Authorization header.

Authorization: Bearer crw_3q2Xv…

Tokens start with crw_. Calls over plain HTTP are not accepted; never put a token in a URL or query string.

Creating a token

In the Cloudraw console: Settings → API → Create token. Choose a name, a scope and an expiry. The token is shown once; the console keeps only a fingerprint (the first characters, shown as prefix) so you can recognise it later.

Tokens are created in the console only — there is no API to create, list or revoke tokens, so a leaked token can never mint another one.

Scope and role ceiling

A token has two limits, and a call must pass both:

The role ceiling is the console role of the admin who created the token. A token never has more power than its creator: a security admin's token can read what a security admin can read, never more. A call outside the ceiling answers 403 insufficient-role. Each operation in the reference shows the token it needs.

Console-only actions

Some actions always need a named person in the console, often with a second-factor check, and answer 403 panel-only to a token: managing admins and API tokens, sign-in method and identity-provider changes, phones and second factors of people, removing / disabling / re-enabling a connector or changing its trust, deleting recordings, remote assist, support access, integrator access, and DNS changes made for you.

Expiry, rotation and revocation

• Expiry: default 90 days, at most 365. An expired token answers 401 token-expired.
• Rotation: create the new token, deploy it, check that its last used time moves in the console, then revoke the old one. Two tokens can be valid at the same time, so rotation needs no downtime.
• Revocation: Settings → API → Revoke takes effect immediately, including for streams that are already open.
• Leaked token? Revoke it first, then look at the audit log filtered by actor=token:<name> to see what it did.

Errors