Cyndra API
Credentials, self-serve.
Register a client, exchange it for a token, call the API. No forms, no approval queue, no sales call.
Three calls
From nothing to authenticated.
# 1. Register (RFC 7591). No credentials needed to do this.
curl -s -X POST https://www.cyndra.ai/api/oauth/register \
-H "Content-Type: application/json" \
-d '{"client_name":"my-agent","scope":"content.read leads.write"}'
# 2. Exchange for a bearer token (RFC 6749 4.4).
curl -s -X POST https://www.cyndra.ai/api/oauth/token \
-d grant_type=client_credentials \
-d client_id=$CLIENT_ID \
-d client_secret=$CLIENT_SECRET \
-d scope="content.read"
# 3. Confirm what the token can do.
curl -s https://www.cyndra.ai/api/v1/me -H "Authorization: Bearer $TOKEN"Tokens are JWTs valid for 60 minutes. Credentials can also be sent as HTTP Basic (client_secret_basic). The authorization server metadata is published at /.well-known/oauth-authorization-server (RFC 8414), and the scopes at /.well-known/oauth-protected-resource (RFC 9728).
Scopes
Ask for the least you need.
| Scope | Grants |
|---|---|
content.read | Read Cyndra's public content: page index, page markdown, blog posts, case studies, changelog and pricing. |
leads.write | Submit a contact request or lead on behalf of a user. Write access is limited to this one action. |
sandbox | Restrict the client to the sandbox environment. Write calls are validated and echoed back without reaching production systems. |
A token missing a required scope gets a 403 with code: "insufficient_scope" and a WWW-Authenticate challenge naming the scope it needed.
Sandbox
Test writes without writing.
curl -s -X POST https://www.cyndra.ai/api/v1/leads \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"email":"ops@acme.com","message":"Intake automation","mode":"sandbox"}'
# => 201 {"object":"lead","accepted":true,"mode":"sandbox","id":null, ...}A client registered with the sandbox scope is restricted to sandbox mode for every write, so a test integration cannot create real data by forgetting a flag.
FAQ
Authentication questions.
How do I get a Cyndra API key?
POST to https://www.cyndra.ai/api/oauth/register with a client name and the scopes you want. Registration is open (RFC 7591), so the response contains your client_id and client_secret immediately, with no approval step and no sales contact.
Which authentication does the Cyndra API use?
OAuth 2.0 client credentials (RFC 6749 §4.4). Exchange your client_id and client_secret at https://www.cyndra.ai/api/oauth/token for a bearer token, then send it as Authorization: Bearer <token>.
Do Cyndra API read endpoints need a token?
No. Everything that only reads content is public and unauthenticated. Tokens are required for GET /api/v1/me and POST /api/v1/leads.
What Cyndra API scopes exist?
content.read: Read Cyndra's public content: page index, page markdown, blog posts, case studies, changelog and pricing. leads.write: Submit a contact request or lead on behalf of a user. Write access is limited to this one action. sandbox: Restrict the client to the sandbox environment. Write calls are validated and echoed back without reaching production systems.
How do I test a Cyndra API write without creating real data?
Send "mode": "sandbox" on POST /api/v1/leads, or register a client with the sandbox scope. The payload is validated and echoed back, and nothing is written.