Skip to main content
Every request carries an API key in the Authorization header:
Keys are issued by Cactus at kickoff and can be rotated or revoked at any time — contact your Cactus representative to manage keys.
Need API keys? Request API access to get started.

​
Live and sandbox keys

Both key types use the same base URL and identical request shapes, so switching your integration from sandbox to live is a one-variable change.

​
Product access

Accounts are enabled per product, so some endpoints may not be available to your account: /v1/documents and /v1/webhook-endpoints are open to every account — uploads and webhook delivery underpin both products. The MCP server advertises only the tools your key can use, so an agent won’t attempt something your account isn’t enabled for.

​
Key safety

  • Keys are shown once at issuance and cannot be recovered — store them in a secrets manager.
  • Send keys only in the Authorization header over HTTPS. Never embed them in client-side code or URLs.
  • If a key may have been exposed, ask us to rotate it — a replacement is issued immediately and the old key is revoked.

​
Errors

Requests without a valid key return 401 with a machine-readable code (missing_api_key, invalid_api_key, revoked_api_key, or expired_api_key). A valid key that can’t reach a product returns 403, and the code tells you who can unblock it: See Errors for every code the API returns.