Ceyu
My account

API quickstart

Create a scoped key, make one request, and handle failures correctly. The examples below are deliberately complete enough to use in production.

1. Create a key

Open Developers in Ceyu, choose Keys, and create an organization key. Copy it once and put it in a secret manager; never commit it or expose it to browser code.

Secret

Ceyu accepts credentials only in the Authorization header. Keys in URLs are rejected because URLs leak into history, referrers, logs, and caches.

2. Make the first request

Send the key as a Bearer credential and pin the API date. A key keeps its configured version, so later compatible additions do not silently change your integration.

curl https://api.ceyu.org/v1/me \
  -H "Authorization: Bearer $CEYU_API_KEY" \
  -H "Ceyu-Version: 2026-08-03"

3. Write idempotently

Every write needs an idempotency key. Reusing the same key with the same body returns the original response; reusing it with different input fails with a conflict.

curl https://api.ceyu.org/v1/tasks \
  -X POST \
  -H "Authorization: Bearer $CEYU_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"workspace":"ws_…","title":"Launch checklist"}'

4. Handle errors

Branch on error.code, retain request_id for support, and honor Retry-After after rate limits or temporary load shedding. Do not retry validation or permission failures.

{
  "error": {
    "type": "invalid_request_error",
    "code": "invalid_request_body",
    "message": "The request body is invalid.",
    "param": "title",
    "request_id": "req_01JAZ…"
  }
}

5. Use the TypeScript SDK

The official client adds version and idempotency headers, applies bounded retries, exposes structured errors, and verifies webhook signatures against the exact raw request body.

import { CeyuClient } from "@ceyu/api";

const ceyu = new CeyuClient({ apiKey: process.env.CEYU_API_KEY });
for await (const task of ceyu.tasks.list({ limit: 20 })) {
  console.log(task.title);
}

6. Receive webhooks safely

A new or changed URL must first return 2xx to a platform.webhook_endpoint.verify event. The signing secret is returned once after that check. Verify every real event against the exact raw bytes before parsing JSON; never verify a re-serialized body.

import { verifyWebhookSignature } from "@ceyu/api";

const rawBody = await request.text();
const candidate = JSON.parse(rawBody);

// The reachability probe arrives before the secret is revealed.
if (candidate.type === "platform.webhook_endpoint.verify") {
  return new Response(null, { status: 204 });
}

await verifyWebhookSignature({
  rawBody,
  signature: request.headers.get("Ceyu-Signature") ?? "",
  secret: process.env.CEYU_WEBHOOK_SECRET,
});

// Process candidate only after verification.

Continue to the generated API reference →