> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.coperniq.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.coperniq.io/_mcp/server.

# Authentication | Coperniq API

> Learn how to authenticate with the Coperniq API using API keys. Generate keys and set request headers for your integration.

## Authentication

All production API requests must include a valid API key in your headers:

```http
GET /projects HTTP/1.1
Host: api.coperniq.io
x-api-key: YOUR_API_KEY
```

* Generate an API key via `POST /api-keys` using Basic Auth (see **API Key** in the sidebar for the full endpoint). Getting a `401`? If you sign in to Coperniq with Google, see [Signing in with Google](#signing-in-with-google).
* Store API keys securely and rotate them regularly.
* You can create multiple keys for different environments or integrations.
* API keys take on the role of the user authenticated when posting to `/api-keys`.
* Send your API key on every request using the `x-api-key` header for all endpoints in the **API Reference**.

## Signing in with Google

`POST /api-keys` needs your Coperniq email and password. If you sign in to Coperniq with Google, your account has no password yet, so the request returns `401`.

To set one:

1. On the Coperniq login page, click **Forgot password**.
2. Enter the email you sign in with and open the reset link we send you.
3. Choose a password.

Then call `POST /api-keys` with that email and password. Google sign-in keeps working as before.

## Best practices for storing API keys

* **Never commit keys to source control.** Use environment variables, a secrets manager, or your platform’s secure config (e.g. GitHub Secrets, AWS Secrets Manager, Vault).
* **Use different keys per environment.** Separate keys for development, staging, and production make rotation and revocation safer.
* **Restrict key access.** Only give key access to systems and people that need it; avoid sharing keys in chat, email, or docs.

## How API keys work

* **Scope:** Each key is tied to the Coperniq user who created it. Requests made with that key run with that user’s permissions and see only the data that user can access.
* **Expiration:** API keys do not expire.

## Managing and revoking API keys

Superadmins can list and delete API keys, and archive API users, through the API (see **API Key** in the sidebar). These endpoints use Basic Auth, like `POST /api-keys`, not an API key.

* **See your company's keys:** `GET /api-keys`. Key values are never shown. Each key has a non-secret `id` and a `keyPreview` (its last 4 characters).
* **Revoke one key:** `DELETE /api-keys/{key_id}`, using the `id` from the list. The key stops working immediately.
* **Retire an integration's API user:** `POST /api-users/{user_id}/archive` deletes all of its keys and deactivates it. Archiving an API user in the Coperniq UI doesn't delete its keys, so use this endpoint instead.
* **Lost a key?** Keys can't be retrieved. Create a new one with `POST /api-keys` and revoke the old one, or contact support.

See **Technical Details** in the sidebar for rate limits and other technical notes.