Get an API token

Generate an organization API key and use it to query Carbide.

Use an API key as your bearer token when connecting to Carbide’s GraphQL API. Each key belongs to one organization, so you don’t need to send an organization ID with your requests.

Generate a key

You must be an active owner or admin of the organization to create or manage API keys.

1. Open API settings

   Sign in to Carbide, select your organization, and open Settings → Organization → API.

   Go to API keys.

2. Generate an API key

   In API keys, select Generate API key. Give the key a name that identifies its purpose, then choose an expiration. The default is 90 days.

   Leave the MCP permission options unchecked when following this GraphQL quickstart; those options control access through AI clients.

3. Copy your token

   Copy the complete key, including its carbide_ prefix, and store it securely.

   Carbide shows the key only once. After you close the dialog, you cannot retrieve it again. If you lose it, generate a replacement and revoke the old key.

Authenticate requests

Send your key in the Authorization header:

Authorization: Bearer carbide_YOUR_API_KEY

GraphQL requests use POST https://app.carbide.work/graphql with a JSON body. For example, set CARBIDE_API_KEY to your key in your local environment and run:

curl https://app.carbide.work/graphql \
  --header "Authorization: Bearer ${CARBIDE_API_KEY}" \
  --header "Content-Type: application/json" \
  --data '{"query":"query { listRequests(first: 10) { count } }"}'

This read-only query returns the request count for the key’s organization.

Use the GraphQL explorer

Open the GraphQL explorer, expand Headers, and paste the following JSON with your actual key:

{
  "Authorization": "Bearer carbide_YOUR_API_KEY"
}

Then run the example on the explorer guide, or browse the public queries and types in the GraphQL API reference.

Expiration and revocation

Expired or revoked keys no longer authenticate. To revoke a key, return to API keys, open its actions menu, and select Revoke key. Revocation takes effect immediately.

If a request returns 401 Unauthorized, check that you copied the complete key, included the Bearer prefix, and that the key has not expired or been revoked. Keep keys out of browser application code, source control, and shared examples.