Before you connect
- Workspace approvalCSFaaS approves API access for your workspace.
- Member accessAfter approval, owners and Account Managers are included unless excluded. Managers can enable access for other members.
- Workspace API switchAPI access must be enabled in Settings → API & MCP.
API keyshttp · bearer
A CSFaaS API key for REST / headless / CI use, created in Settings ▸ API & MCP: Authorization: Bearer csfaas_sk_<key_id>_<secret>. The key acts as the user it is bound to, with that user's live permissions; bound to one workspace; read-only unless minted with the read_write access level. (MCP clients connect via browser sign-in — OAuth 2.1 — not this key.)
User session tokenshttp · bearer
A CSFaaS user session token (JWT). Browser callers must also send an X-Workspace-Id: <uuid> header. Browser sessions are READ-ONLY on the REST API — write verbs are hard-refused with 403 browser_read_only.
Permissions and write access
API access does not grant additional data permissions. A key uses its bound user’s live workspace permissions. Writes also require a credential with write access and an enabled workspace write setting.
Manage API & MCP settings