API keys and webhooks

API keys

Keys are included from the Analyst plan. Create one under API Keys. The full key is shown once, when it is created, so copy it then. Afterwards only its prefix is shown. Send it as Authorization: Bearer cs_live_…. Revoke a key the moment it may have leaked; revoked keys stop working immediately.

Two limits apply. The rate limit is per minute and shown on the page for your plan. The daily quota on the public data endpoints resets at midnight UTC: 100 a day on the free plan, 10,000 on Analyst, 100,000 on Agency. Every response carries headers saying how much is left.

The full reference is at API docs.

Webhooks: two kinds

On a trigger (Analyst and above). Each parametric trigger can post to its own URL when it approaches or breaches. Open the trigger from Triggers, choose Edit, and set the webhook URL (https only) and a secret. Without a secret no webhook is sent, because the secret is what signs it.

Account-wide (Analyst and above). One endpoint under Webhooks receives every trigger event on the account. You choose which event types it gets, and recent deliveries are listed with their status.

Verifying a delivery

Every delivery carries an X-Calchis-Signature: sha256=… header: the HMAC-SHA256 of the raw request body with your signing secret. Compute the same on your side and compare before trusting the payload. If a secret may have leaked, rotate it. The old one stops signing at once, so update your receiver at the same time.