Skip to content
CommissionSight Docs

Authentication

Every API request is authenticated with an account API token, sent as a bearer token:

Authorization: Bearer cs_your_token_here

Tokens are issued by a CommissionSight administrator and scoped to a single account — a token can only ever read or write that account’s data. Keep it secret; treat it like a password.

Using your token

Terminal window
curl https://api.commissionsight.com/v1/me \
  -H "Authorization: Bearer $CS_TOKEN"

Or use the official TypeScript SDK (npm i @commissionsight/sdk — zero dependencies):

import { CommissionSightClient } from '@commissionsight/sdk';


const client = new CommissionSightClient({
  baseUrl: 'https://api.commissionsight.com/v1',
  token: process.env.CS_TOKEN,
});

Getting a token

API tokens are provisioned for your account during onboarding. Need one (or a rotation)? Contact the CommissionSight team — we issue your token and show it once at creation, so store it securely (e.g. a secrets manager).

Errors & limits

All errors are RFC-9457 problem+json:

{ "type": "about:blank", "title": "Invalid or revoked token", "status": 401, "code": "unauthorized" }
  • 401 unauthorized — missing, invalid, or revoked token.
  • 403 account_pending — the account hasn’t been approved yet.
  • 429 — rate limit exceeded; honor the Retry-After header.

Requests are rate-limited per token.

Security

  • In transit: all API traffic is HTTPS/TLS.
  • At rest: API tokens are stored only as SHA-256 hashes; each account’s statement data lives in its own isolated database, and the connection string is encrypted (AES-GCM). A token can only ever resolve to its own account’s data — never another’s.
  • Webhooks are HMAC-signed (X-CommissionSight-Signature: sha256=…) so you can verify payloads.
  • Tokens are revocable; revoking immediately invalidates access.