JavaScript
Accounts
Get the current account
The account behind your token, and the three server-managed secrets that live on it.
GET
JavaScript
The account is the top of the tree: it holds your workspaces, profiles, and API keys, and billing lives here. This endpoint returns the account your token belongs to, and it is the one place three account-level secrets are exposed.
It is account-scoped, so there is no The three secrets in
The key that signs every webhook Cadenya sends, in Standard Webhooks
Rotate it with
The API key auto-provisioned with the account.
Because a read hands back a working credential, treat the whole
The token Cadenya sends in the
workspaceId in the path. spec carries billingEmail, description, domain, and the list of workspaces.
The three secrets in info
info holds credentials the server manages for you. Handle the response like a secret: it is the only read that exposes these.
webhookEventsHmacSecret
The key that signs every webhook Cadenya sends, in Standard Webhooks wh_... format. This is what you verify an incoming signature against, so a webhook handler reads it once at setup and stores it in your own secret manager.
client.account.rotateWebhookSigningKey(). The rotation response carries the new value once; update your verifier before you rotate, or in-flight deliveries fail their signature check.
globalApiKey
The API key auto-provisioned with the account. spec.token is returned on every GetAccount call, so this endpoint is how you retrieve the global key whenever you need it, not only once.
GetAccount response as secret-bearing: do not log it, and scope who can call it. Rotate the key to invalidate the old value.
challengeToken
The token Cadenya sends in the X-Cadenya-Challenge-Token header on every MCP tools/list request. An MCP server can accept a valid challenge token in place of per-user auth when listing tools, while still requiring real auth on tools/call. Rotate with client.account.rotateChallengeToken(), and update any server validating it before you rotate, or its tools/list starts rejecting Cadenya.
Rotate before you break
Each secret has a rotate endpoint, and each rotation is a cutover: the old value stops working the moment the new one is minted. The safe order is the same for all three.- Rotate, and capture the new value from the response.
- Update the consumer (your webhook verifier, your MCP server, your stored key).
- Confirm the consumer accepts the new value.
tools/list is rejected.
Identity versus account
GetAccount tells you which account. /v1/whoami tells you which profile is holding the token inside it, and /v1/workspaces tells you which workspaces that identity can reach. The three together are the whole “who am I and what can I touch” picture.
Related
Webhooks
Verifying a signature against
webhookEventsHmacSecret.Rotate the webhook signing key
Mint a new HMAC secret, and the cutover to plan around.
List workspaces
What the account’s token can reach.
Get the current profile
The identity behind the token.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Response
OK
An account, the top-level organizational unit. Contains workspaces and account-wide settings such as the webhook signing secret.