Base URL & versioning

Available

Where every SDK endpoint lives, and how versions are handled.

Every public SDK endpoint lives under one base URL and one version prefix.

text

https://ctrlapp.krdcode.com/api/public/sdk/v1/<endpoint>

All requests use HTTPS.
Path is versioned (v1). Breaking changes ship a new prefix.
Auth and CORS are route-specific. Most routes take a publishable SDK key; blog reads take no auth; /codegen takes a dashboard PAT. Follow the individual endpoint page for the exact header and CORS headers it advertises — do not assume every route accepts browser calls with a publishable key.
Every route under /api/public/* bypasses Lovable's built-in auth; each handler enforces its own authentication (or none, for blog).
Never put a PAT in browser or mobile code. PATs authenticate a dashboard user and grant workspace-level access.