# API Reference

Build custom integrations with the Crumbless REST API. All endpoints require authentication and return JSON.

## Base URL

Choose a running app instance you operate or an API endpoint provided by your operator. For local use, configure the app and its dependencies, run npm run dev from the repository root, and wait for the ready message. Set CRUMBLESS\_API\_BASE\_URL in your shell to that app's actual origin followed by /api/v1, without a trailing slash. A configured default is not proof of a deployed API. Use credentials issued by that same instance.

`$CRUMBLESS_API_BASE_URL` 

## Authentication

Every request needs a `Bearer` token in the `Authorization` header.

### Supabase JWT (CLI / Web session)

Obtained through CLI or web login. The CLI manages session renewal. For direct REST requests, supply a valid, unexpired access token.

`Authorization: Bearer <jwt_token>`

### API Key (integrations)

Long-lived key generated from the [dashboard](/app/api-keys). Access depends on the key's scopes and permitted brands. Keys currently start with `crumbless_`.

`Authorization: Bearer $CRUMBLESS_API_TOKEN`

## Error Handling

All errors return a consistent JSON body:

`{ "error": "Human-readable message" }`

| Code | Meaning |
| --- | --- |
| `401` | Unauthorized — missing or invalid token |
| `403` | Forbidden — API key has no access to this brand |
| `404` | Not found |
| `405` | Method not allowed |
| `500` | Internal server error |

## Quick Start

Set CRUMBLESS\_API\_TOKEN in your environment to your actual REST credential before running these commands. Keep it out of source control, chat and shared logs.

```
curl -H "Authorization: Bearer $CRUMBLESS_API_TOKEN" "$CRUMBLESS_API_BASE_URL/brands"

curl -H "Authorization: Bearer $CRUMBLESS_API_TOKEN" "$CRUMBLESS_API_BASE_URL/brands/my-brand/posts"
```

---
Source: https://crumbless.app/docs/api