Create and protect a CallOnline API key

CallOnline authenticates protected API operations with an HTTP bearer token. The service hashes the presented token before comparing it with an active key record; revoked keys do not authenticate.

Create the narrowest useful key

Open the App9 Account API key dashboard and create a key for one environment and one integration. Grant only what it uses:

Scope	Use
callonline.calls	Create calls and use call actions
callonline.webhooks	Create, list, and delete webhook subscriptions
callonline.billing	Read billing readiness and use agent-commerce endpoints
*	Full access; reserve for controlled administration

Do not reuse a production key in local development or staging. Separate keys make rotation and incident review much simpler.

Send the key from a trusted server

export CALLONLINE_API_KEY="replace-with-secret-from-your-vault"

curl https://callonline.app/v1/voices \
  --header "Authorization: Bearer $CALLONLINE_API_KEY"

Never embed the bearer value in browser JavaScript, mobile application resources, screenshots, public agent prompts, source-control history, or query strings. Avoid printing the full value in CI output. If a support workflow needs to identify a key, log a safe internal ID or a short non-secret label instead.

Handle authentication errors

• HTTP 401 means no active key authenticated. Check the Bearer prefix, whitespace, environment, revocation state, and whether the exact secret was truncated.
• HTTP 403 with a scope message means the key authenticated but lacks the required permission. Create or update a deliberately scoped key instead of switching every integration to *.
• A billing or compliance denial is not fixed by broader key scope. Read the response error and correct the relevant prerequisite.

Rotation checklist

1. Create a replacement key with the same minimal scopes.
2. Update the server-side secret in one environment.
3. Run a non-billable check such as a permitted read endpoint.
4. Deploy the consumer and confirm the new key is in use.
5. Revoke the old key.
6. Review logs and repository history if exposure was possible.

Rotate immediately after accidental disclosure. Deleting a message or rewriting git history is not a substitute for revocation.

Keys and MCP

The MCP documentation tools search only public material and do not require a key. Action tools such as place_call forward the request authorization to the protected API, so an MCP client still needs an appropriately scoped credential for real account actions.