Authentication

Authenticate every protected request with your API key in the Authorization header:

Authorization: Bearer <your-api-key>

Getting a key

Generate one under Account → API keys at app.cotes.ai.

The key is shown once, at the moment you create it. We store only a hash, so we cannot show it to you again — if you lose it, revoke it and make another. Keys start with cotes_sk_.

A key belongs to your account and carries your access: it works while your trial or subscription is live and stops when that lapses. You can hold two at a time, which is enough to rotate one out without downtime.

Revoking takes effect on the next request the key makes — including on an open stream, which ends with an unauthorized event rather than simply going quiet.

Example

curl -sS \
  -H "Authorization: Bearer $COTES_API_KEY" \
  "https://api.cotes.ai/v1/contests/active?series=KXBTC15M"

Send the key in the header, never in a query string — URLs end up in access logs and traces in a way headers do not.

Status	Meaning
401	Missing, unknown, or revoked key
402	The key is genuine, but the account’s trial or subscription has lapsed — renew at app.cotes.ai

Both carry problem+json.