Skip to main content
All Caspr API requests require an API key passed as a Bearer token in the Authorization header.

​
Get an API key

API keys are scoped per organization and provisioned by our team. Email support@usepeppr.ai with your organization name to request access. Keys look like:
Treat your API key like a password. Never commit keys to source control, paste them into shared docs, or expose them in client-side code. If a key leaks, contact support immediately to rotate it.

​
Making authenticated requests

Include the key in the Authorization header on every request.

​
Scoping

Every API key is bound to a single organization. All responses are automatically filtered to resources that belong to that organization — you cannot read another customer’s data even if you knew their session IDs. Within an organization, the key has read and write access to:
  • Sessions, transcripts, and threads
  • Call analysis and notes
  • Knowledge base (connectors, QA pairs, documents)
  • Dashboard analytics

​
Rate limits

Rate limits are enforced per API key.
When you exceed the limit, Caspr returns 429 Too Many Requests with a Retry-After header indicating how many seconds to wait before retrying.
For higher limits, reach out to support@usepeppr.ai.

​
Error responses

All errors follow the same envelope.
The API key is missing, malformed, or revoked. Check that your Authorization header is present and uses the format Bearer pk_live_....
Your API key is valid but doesn’t have access to the requested resource. This typically means the resource belongs to a different organization.
The resource doesn’t exist, or your key doesn’t have access to it. Caspr returns 404 (not 403) for resources you can’t access, to avoid leaking existence information.
You’ve hit the rate limit. Back off using the Retry-After header value.
Something went wrong on our side. 5xx responses are safe to retry with exponential backoff — idempotent reads (GET) won’t double-process.

​
Security best practices

Store keys in environment variables or secret managers — never in code.
Use different keys per environment — separate dev, staging, and production.
Rotate keys periodically — especially after employee changes.
Scope responsibly — use the lowest-privilege key that gets the job done.
Monitor usage — unexpected traffic spikes may indicate a compromised key.