Get started

Keys carry the owner's authority

One secret, sent on every request. What it can reach is decided by what you own, not by anything stored on the key.

Sending your key

Keys are made on your cormac profile page and start with cormac_live_. A key reaches the servers you own where cormac+ is active, by subscription or override. Handing it to your own developer is fine: it carries your authority and nothing else. Send it either way:

Either header works

Authorization: Bearer cormac_live_...
# or
X-Api-Key: cormac_live_...

Scopes

A key does only what it was given scopes for, chosen when it's made and fixed after that. Nothing is selected by default. Asking for something outside them is a 403 FORBIDDEN_SCOPE.

guilds:readServers: List your servers and read one server, including its plugin list.
stats:readStatistics: Member, message, moderation and voice statistics, with per-channel and hourly breakdowns.
members:readMembers: Look up one member: their Discord profile and what each enabled plugin keeps about them.
progression:readProgression: Leaderboard standings and a single member's level and XP.
tickets:readTickets: Ticket analytics and the live open ticket queue.
honeypot:readHoneypot: Honeypot catch counts, in total and per trap channel.
diagnostics:readDiagnostics: The setup diagnostics report for a server.
moderation:readModeration cases: Moderation cases: the server's case list and each member's warnings, timeouts, kicks and bans.

Write scopes change data cormac keeps about a member. Every change shows in the server's Recent changes with the key's name, so you can always see what a key did.

progression:writeChange XP: Set, add or remove a member's XP, or set their level. Reward roles follow.
automod:writeAutomod strikes and exemptions: Clear a member's automod strikes, and exempt them from a rule or stop exempting them.

Scope is live, never stored

Every request works out again what the key may read. Revoking a key stops it at once. Losing cormac+ or transferring a server drops that server out of reach within a minute, with no change to the key. Turning a plugin off makes its endpoints answer 409 PLUGIN_DISABLED just as quickly.

Keep it server-side

Treat the key like a password. Never ship it in code that runs in visitors' browsers, where anyone can read it; call the API from your own backend instead. Browsers are refused writes outright, at the CORS preflight. The cormac_live_ prefix is there so secret scanners can catch an accidental commit.