Skip to navigation
Coperniq API

Authentication | Coperniq API

Authentication

All production API requests must include a valid API key in your headers:

GET /projects HTTP/1.1
Host: api.coperniq.io
x-api-key: YOUR_API_KEY
  • Generate an API key via POST /api-keys using Basic Auth (see API Key in the sidebar for the full endpoint). Getting a 401? If you sign in to Coperniq with Google, see Signing in with Google.
  • Store API keys securely and rotate them regularly.
  • You can create multiple keys for different environments or integrations.
  • API keys take on the role of the user authenticated when posting to /api-keys.
  • Send your API key on every request using the x-api-key header for all endpoints in the API Reference.

Signing in with Google

POST /api-keys needs your Coperniq email and password. If you sign in to Coperniq with Google, your account has no password yet, so the request returns 401.

To set one:

  1. On the Coperniq login page, click Forgot password.
  2. Enter the email you sign in with and open the reset link we send you.
  3. Choose a password.

Then call POST /api-keys with that email and password. Google sign-in keeps working as before.

Best practices for storing API keys

  • Never commit keys to source control. Use environment variables, a secrets manager, or your platform’s secure config (e.g. GitHub Secrets, AWS Secrets Manager, Vault).
  • Use different keys per environment. Separate keys for development, staging, and production make rotation and revocation safer.
  • Restrict key access. Only give key access to systems and people that need it; avoid sharing keys in chat, email, or docs.

How API keys work

  • Scope: Each key is tied to the Coperniq user who created it. Requests made with that key run with that user’s permissions and see only the data that user can access.
  • Expiration: API keys do not expire.

Managing and revoking API keys

Superadmins can list and delete API keys, and archive API users, through the API (see API Key in the sidebar). These endpoints use Basic Auth, like POST /api-keys, not an API key.

  • See your company’s keys: GET /api-keys. Key values are never shown. Each key has a non-secret id and a keyPreview (its last 4 characters).
  • Revoke one key: DELETE /api-keys/{key_id}, using the id from the list. The key stops working immediately.
  • Retire an integration’s API user: POST /api-users/{user_id}/archive deletes all of its keys and deactivates it. Archiving an API user in the Coperniq UI doesn’t delete its keys, so use this endpoint instead.
  • Lost a key? Keys can’t be retrieved. Create a new one with POST /api-keys and revoke the old one, or contact support.

See Technical Details in the sidebar for rate limits and other technical notes.