Should I use an API key or an OAuth client for the Casafari REST API?

Both an API key and an OAuth client authenticate the self-serve platform's REST API; both are created in the console, and they differ in how each is sent.

• API key: a cf_sk_… value, shown once when you create it in the console. Send it in the X-API-Key header or as Authorization: Bearer <api_key>, never in a URL. See creating a key and keeping it safe.
• OAuth client: exchange its client credentials at https://platform.casafari.com/oauth/token with resource set to the product's URL. Access tokens last 15 minutes and there is no refresh token, so you request a new token when one expires. See getting a client-credentials token.

Free allows 2 API keys and 2 OAuth clients, Agent 5 of each, and Custom follows its contract; for other accounts the numbers are not published. Casafari publishes no recommendation of one credential over the other; Casafari can answer (https://www.casafari.com/).

Existing Casafari clients authenticate to the Casafari REST API differently: see REST authentication.