Authentication

All API requests (except /health) require a valid API key passed as a Bearer token in the Authorization header.

API key format

cmp_live_aBcDeFgH.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Segment	Description
`cmp`	Key prefix (always `cmp`)
`live` or `test`	Environment (`live` for production, `test` for sandbox)
`aBcDeFgH`	8-character lookup identifier
`.xxx...`	44-character secret

Making authenticated requests

Pass your key in the Authorization header with the Bearer scheme:

curl https://prod-api.civicmarketplace.com/v1/contracts \
  -H "Authorization: Bearer cmp_live_aBcDeFgH.your_secret_here"

Environments

Environment	Key prefix	Base URL
Production	`cmp_live_`	`https://prod-api.civicmarketplace.com`
Sandbox	`cmp_test_`	`https://uat-api.civicmarketplace.com`

Use test keys during development. They connect to sandbox data and won’t affect production.

Data scoping

Each API key is scoped to a partner account. You will only see contracts and suppliers that your partner account has been granted access to. If you need access to additional data, contact your account manager.

Key rotation

When you rotate your API key, the previous key can optionally be revoked immediately. Plan for a brief overlap period if you need zero-downtime rotation:

Request a new key from your account manager
Update your application to use the new key
Confirm the old key is no longer in use
Request revocation of the old key

Error responses

If your key is missing, invalid, or revoked:

{
	"error": {
		"code": "unauthorized",
		"message": "Missing or invalid API key",
		"request_id": "req_abc123"
	}
}

If your key is valid but you are accessing data outside your partner scope:

{
	"error": {
		"code": "forbidden",
		"message": "This resource is not accessible with your API key",
		"request_id": "req_def456"
	}
}

Get Started

AI Connector (MCP)

Core Concepts

Guides

About

Overview

Contracts

Suppliers

Taxonomy

API key format

Making authenticated requests

Environments

Data scoping

Key rotation

Error responses

​API key format

​Making authenticated requests

​Environments

​Data scoping

​Key rotation

​Error responses

API key format

Making authenticated requests

Environments

Data scoping

Key rotation

Error responses