Authentication overview

5 min read Updated October 22, 2026

Two ways to authenticate

1. API key (simplest): send it in the x-api-key header on every request 2. OAuth 2.0 Bearer token: exchange your key for a short-lived token with the client-credentials grant, then send Authorization: Bearer

API key

bash

curl -H "x-api-key: $CG_API_KEY" https://api.compliancegrid.ai/v1/hs/search?q=cotton

Bearer token

Your credential has a client_id; your API key is the client_secret.

bash

curl -X POST https://api.compliancegrid.ai/oauth/token \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=$CG_API_KEY"

json

{
  "access_token": "eyJhbGciOiJSUzI1NiI...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "api",
  "env": "production"
}

Token lifecycle

Expiry: production tokens last 1 hour (3600 s); sandbox tokens last 24 hours
Refresh: there is no refresh token; request a new one
Revocation: POST /oauth/revoke with token
Introspection: POST /oauth/introspect with token

Security practices

Never put keys or tokens in browser code
Keep keys in a secrets manager
Rotate keys regularly (see *Rotating API keys without downtime*)
Subscribe only to the APIs you use

Was this article helpful?