Authentication and API keys

The API Gateway accepts scoped CHAMPREP API keys for server integrations and automation. Browser-based account sessions are used to manage keys, but a custom integration should authenticate its service requests with an API key.

Create a key

1. Open API Keys.
2. Choose a name that identifies the workload and environment.
3. Select only the service scopes the workload needs.
4. Add an IP allowlist when the workload has stable outbound addresses.
5. Copy the key once and store it in a secret manager or keychain.

Do not create one broadly scoped key for every application. Separate keys make rotation, audit review, and incident response safer.

Send the credential

Authorization: Bearer YOUR_API_KEY

For shell examples, keep the value in an environment variable:

curl --fail-with-body \
  --header "Authorization: Bearer $CHAMPREP_TOKEN" \
  https://api.champrep.com/v1/auth/whoami

Do not put a key in a URL, query parameter, frontend JavaScript bundle, mobile application, log line, or analytics event.

Scope catalog

The following public scopes are grouped by service. The dashboard displays the scopes currently available to the account.

Service	Read or use	Write or manage
Identity	users:read, api:read, cli:use	api:manage
Drive	drive:read	drive:write, drive:delete
Chat	chat:read	chat:write
Calendar	calendar:read	calendar:write
Contacts	contacts:read	contacts:write
Meet	meet:read	meet:write
Notes	notes:read	notes:write
Learn	courses:read	courses:write
CHAMPREP AI	ai:chat	ai:chat
Mail	mail:read	mail:write, mail:send
Work	work:read	work:write, work:delete
Invoice	invoice:read	invoice:write, invoice:send, invoice:delete
Business	business:read	business:manage
Billing	billing:read	billing:manage
Org Chart	charts:read	charts:write, charts:delete
CHAMPREP QA	qa:read	qa:write
Forms	forms:read	forms:write
Webhooks	—	webhooks:manage

The wildcard scope grants broad access and should be reserved for tightly controlled administrative integrations. A scope permits a category of action; it does not override plan, role, organization, or resource permissions.

Key lifecycle

Rotate

Create or regenerate a replacement key, deploy it, confirm the workload is using it, and then revoke the previous key. Avoid a rotation that leaves an unattended workload with no valid credential.

Revoke

Revoke a key immediately if it is exposed, copied to an untrusted system, or no longer belongs to an active workload. A revoked key should return 401 and must not be retried indefinitely.

Review

Regularly review key names, scopes, IP restrictions, last-used information, and audit activity. Delete unused keys instead of keeping them for a possible future script.

Browser login and CLI login

champrep auth login uses a browser approval flow for a person at a terminal. champrep auth token stores a scoped API key for automation. The CLI protects stored credentials with the operating-system keychain and sends all networked commands through the Gateway.

See CLI authentication and API keys for CLI automation for those workflows.