Authentication

Authenticate every protected request with your API key in the Authorization header:

Authorization: Bearer <your-api-key>

Getting a key

Generate one under Account → API keys at app.cotes.ai.

The key is shown once, at the moment you create it. We store only a hash, so we cannot show it to you again — if you lose it, revoke it and make another. Keys start with cotes_sk_.

A key belongs to your account and carries your access: it works while your trial or subscription is live and stops when that lapses. You can hold two at a time, which is enough to rotate one out without downtime.

Revoking takes effect on the next request the key makes — including on an open stream, which ends with an unauthorized event rather than simply going quiet.

Example

curl -sS \
  -H "Authorization: Bearer $COTES_API_KEY" \
  "https://api.cotes.ai/v1/contests/active?series=KXBTC15M"

Send the key in the header, never in a query string — URLs end up in access logs and traces in a way headers do not.

Status	Meaning
401	Missing, unknown, or revoked key
402	The key is genuine, but access is not. A lapsed trial or subscription says to renew at app.cotes.ai. A live trial that needs a card says to add one at app.cotes.ai/subscribe.

Both carry problem+json.

Python

import os
import requests

session = requests.Session()
session.headers["Authorization"] = f"Bearer {os.environ['COTES_API_KEY']}"

r = session.get("https://api.cotes.ai/v1/contests/active",
                params={"series": "KXBTC15M"}, timeout=10)
r.raise_for_status()
contest = r.json()
print(contest["ticker"], len(contest["signals"]), "signals")

Read the key from an environment variable or a secrets manager. Don’t commit it to a repository or ship it inside a browser or mobile app, where anyone can read it; call the API from your own backend instead.

Rotating a key

Because an account can hold two live keys, you can replace one without downtime:

1. Create a second key under Account → API keys.
2. Deploy it everywhere the old key is used.
3. Confirm requests succeed with the new key.
4. Revoke the old key. Any request or open stream still using it gets 401 (or a final unauthorized event) on its next check.

Rotate straight away if a key may have leaked, for example after it appears in a log, a screenshot or a public commit.