Skip to main content

​
API keys

Create keys under API Keys in the dashboard. They start with ctz_live_ and contain 47 characters. The full key is shown once. ctz_live_... in this documentation is a placeholder, not a usable key.

​
Send the credential

Read COTIZAVE_API_KEY from private server configuration and trim leading and trailing whitespace. Use the quickstart clients, which reject redirects and check responses. Send the key in the header, never in the URL.

​
Create, rotate and revoke

To replace a key, use dashboard rotation. You can invalidate the previous key during rotation; paid plans also allow a 60-minute overlap while deploying the new one. For a leaked key, choose revocation without overlap. The new key is shown once: update your services before the selected window ends. Revocation does not allow the key to be recovered or reactivated. Creating multiple keys does not multiply the account’s monthly quota.

​
Keep the key on the server

Browsers and apps distributed to users must call your backend. Keep the key out of bundles, repositories, error messages, logs and screenshots. Keep TLS verification enabled. An API key and a webhook signing secret are separate credentials.

​
Access errors

​
Continue

Read about quotas and errors. Do not repeatedly retry an invalid key: IP protection may also be triggered.