Authentication

The REST API uses the same authentication as the dashboard itself — a Bearer token (JWT) obtained after login. There's currently no separate long-lived API key for account-wide programmatic access — the token, like a regular session, is valid for a limited time.

Don't confuse this with the widget's data-api-key — that one is scoped to a single domain, grants no access to the rest of the account, and is only meant for public, non-sensitive requests (loading the banner config, recording a consent event).

Getting a token

curl -X POST https://api.cookiestack.dev/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"••••••••"}'

# → { "token": "eyJhbGciOi..." }

Using the token

curl https://api.cookiestack.dev/v1/domains \
  -H "Authorization: Bearer eyJhbGciOi..."

Every organization-level endpoint — domains, stats, and consent records — accepts only this header. The token identifies a specific organization: requests are always scoped to its own data, with no path to another organization's domains under any circumstances.

Next

• Domains API
• Consent records API