Skip to main content
GET
JavaScript
The account is the top of the tree: it holds your workspaces, profiles, and API keys, and billing lives here. This endpoint returns the account your token belongs to, and it is the one place three account-level secrets are exposed.
It is account-scoped, so there is no workspaceId in the path. spec carries billingEmail, description, domain, and the list of workspaces.

The three secrets in info

info holds credentials the server manages for you. Handle the response like a secret: it is the only read that exposes these.

webhookEventsHmacSecret

The key that signs every webhook Cadenya sends, in Standard Webhooks wh_... format. This is what you verify an incoming signature against, so a webhook handler reads it once at setup and stores it in your own secret manager.
Rotate it with client.account.rotateWebhookSigningKey(). The rotation response carries the new value once; update your verifier before you rotate, or in-flight deliveries fail their signature check.

globalApiKey

The API key auto-provisioned with the account. spec.token is returned on every GetAccount call, so this endpoint is how you retrieve the global key whenever you need it, not only once.
Because a read hands back a working credential, treat the whole GetAccount response as secret-bearing: do not log it, and scope who can call it. Rotate the key to invalidate the old value.

challengeToken

The token Cadenya sends in the X-Cadenya-Challenge-Token header on every MCP tools/list request. An MCP server can accept a valid challenge token in place of per-user auth when listing tools, while still requiring real auth on tools/call. Rotate with client.account.rotateChallengeToken(), and update any server validating it before you rotate, or its tools/list starts rejecting Cadenya.

Rotate before you break

Each secret has a rotate endpoint, and each rotation is a cutover: the old value stops working the moment the new one is minted. The safe order is the same for all three.
  1. Rotate, and capture the new value from the response.
  2. Update the consumer (your webhook verifier, your MCP server, your stored key).
  3. Confirm the consumer accepts the new value.
Do it in the other order and you get a window where signatures fail or tools/list is rejected.
For the webhook HMAC secret and the challenge token, the rotate response is the only place the new value appears. GetAccount shows those two exist, not their values. Capture them from the rotate call. The global API key is the exception: GetAccount returns its token on every read, so you can always fetch it back.

Identity versus account

GetAccount tells you which account. /v1/whoami tells you which profile is holding the token inside it, and /v1/workspaces tells you which workspaces that identity can reach. The three together are the whole “who am I and what can I touch” picture.

Webhooks

Verifying a signature against webhookEventsHmacSecret.

Rotate the webhook signing key

Mint a new HMAC secret, and the cutover to plan around.

List workspaces

What the account’s token can reach.

Get the current profile

The identity behind the token.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Response

OK

An account, the top-level organizational unit. Contains workspaces and account-wide settings such as the webhook signing secret.

metadata
object
required

AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

spec
object
required

Configuration for an account.

info
object
required

Server-populated information about the account.