Security and Authentication
Table of Contents
Overview
The Cirrus REST API is served over HTTPS, and unencrypted HTTP is not supported to ensure data privacy.
In addition, all requests are required to pass Bearer Token (BearerAuth) for authentication, where the token is predetermined and provided by Cirrus.
All requests are logged and validated.
All parameters must be URL-encoded.
- Security Scheme Type: HTTPS
- HTTP Authorization Scheme: bearer
Obtaining an API Key / Access Token
Note: Admin privileges are required in order to obtain the Access Token / API Key.
A Bearer Token must be set in the Authorization header of every API call.
In the Cirrus console, navigate to Settings > API (in the Settings & Features section):
- Click the View icon next to the API Key.
- Click the Copy icon on the right.
- At the request Authorization tab, select Bearer Token from the Type dropdown list.
- At the Token field, paste your Access Token / API Key value.
Warning: API tokens can pose a security risk to your organization if used by an unauthorized person. Make sure to keep them secure. Delete old keys and replace them in your system if you suspect any security breach.
Replacing/Rotating API Tokens
API Keys rotate automatically in a pre-set schedule. To reset that schedule or obtain a new key, follow the steps below:
- Navigate to Settings > API.
- Click the Revoke icon at the far right of the existing API Key. A new dialog box will inform you have a 30-day grace period to replace the old key with the new one. Click the Revoke Key button.
- At the new dialog box, determine how long the new key will be active. You may copy it to other locations from there or do so later within your 30-day grace period.
- Finish the process by clicking Done.
- The New API key is displayed above the old one. After 30 days, the old API key will expire.
- You may delete the Revoked/Expired key by clicking the Trash Bin icon.

Obtaining a STREAM ID
A STREAM ID is required for every communication channel (Chat, WhatsApp, etc.).
If you don’t know the Stream ID, substitute it with the encrypted version (called StreamProviderId):
- At the Cirrus console, navigate to Settings and select the communication channel.
- Click on the communication channel of your choice from the listed channels. The ID number issued by Cirrus is right underneath the channel name.
- Place this code wherever you see the {STREAM_ID} section of the API.