Authentication

Every inventory request uses a company-scoped Bearer API key.

Authorization: Bearer clx_live_key_01abc.secret

Key properties

• Keys are created only by company admins on Pro or Enterprise.
• v1 keys have the read scope only.
• A key can access records belonging to its own company; client-supplied company identifiers are ignored.
• Coilinx stores a one-way hash, not the complete key.
• Downgrading from Pro, an inactive billing state, or revoking the key blocks access immediately.

Storage

Store the key in a server-side secret manager or encrypted CI secret. Do not:

• commit it to a repository;
• expose it through NEXT_PUBLIC_* or equivalent browser environment variables;
• send it in query strings;
• include it in logs, screenshots, or support tickets.

Rotation

Coilinx supports multiple active keys so rotation does not require downtime:

1. Create a replacement key with a descriptive label.
2. Deploy the new key to the consuming system.
3. Confirm last used updates for the new key in the dashboard.
4. Revoke the old key.

Revocation is permanent. If a key is lost or exposed, revoke it immediately and create a replacement.

Authentication errors

401 INVALID_API_KEY means the key is absent, malformed, unknown, or revoked. 403 FEATURE_LOCKED means the associated company no longer has API access. 403 INSUFFICIENT_SCOPE means the key cannot perform the requested operation.