Authentication

Every endpoint requires an account-scoped customer API token. The token determines which account the request reads and writes — there is no account ID to pass and no way to reach another account with your token.

Getting a token

Creating a key

Creating, naming, and revoking a key all happen in the dashboard, under Settings > Integrations > API keys. See the API Keys guide for that walkthrough, screenshots included.

Keys don't expire

API keys currently do not have an expiration date. If you believe a key has been compromised, email support@superfunnel.ai to revoke it.

Sending the token

Put the token in the x-api-key header, prefixed with Bearer :

x-api-key: Bearer YOUR_API_TOKEN

The prefix is part of the value

Unlike the standard Authorization header, the Bearer prefix goes inside x-api-key. A request sent as x-api-key: YOUR_API_TOKEN, without the prefix, is rejected with 401.

Requests with a JSON body also need Content-Type: application/json.

curl -X GET 'https://api.superfunnel.ai/v1/cms/collections' \
  -H 'x-api-key: Bearer YOUR_API_TOKEN'

const response = await fetch('https://api.superfunnel.ai/v1/cms/collections', {
  headers: {
    'x-api-key': `Bearer ${process.env.SUPERFUNNEL_API_TOKEN}`,
  },
})

const data = await response.json()

import os
import requests

response = requests.get(
    'https://api.superfunnel.ai/v1/cms/collections',
    headers={'x-api-key': f"Bearer {os.environ['SUPERFUNNEL_API_TOKEN']}"},
)

print(response.json())

Keeping tokens safe

A token is a full account credential

A customer API token can read and change all of the CMS content and analytics in the account it belongs to. Treat it like a password.

Store tokens in a secret manager or a server-side environment variable.
Never ship one in browser code, a mobile app, or a public repository.
Use a separate token per integration, so one can be revoked on its own.
Email support to revoke a token you believe has leaked.

The Try it panels in this reference keep the token you paste in sessionStorage for the current browser tab only. It is sent directly to api.superfunnel.ai and never to the documentation site, and it is discarded when you close the tab. Code snippets on these pages always show a YOUR_API_TOKEN placeholder rather than the value you typed, so copying one is safe.