Authentication

Authentication#

Every request needs your API key as a Bearer token:

Authorization: Bearer cc_your_key_here

Requests without a valid key return 401:

{
  "error": {
    "message": "Missing or invalid API key.",
    "type": "authentication_error",
    "code": "invalid_api_key"
  }
}

Keys are stored only as SHA-256 hashes — we cannot recover a lost key, so generate a new one and revoke the old.

Key scopes#

Each key carries a set of scopes. A request outside a key's scopes returns 403 with code insufficient_scope.

New keys receive all three scopes by default. Most coding agents call /models before their first completion, so keep models:read enabled unless you have a specific reason to narrow the key.

Rate limits#

Two independent limits apply per minute, based on your plan:

• RPM — requests per minute
• TPM — tokens per minute (prompt + completion combined)

Every response reports your current state:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 297
X-RateLimit-Reset: 1787305980
X-RateLimit-Limit-Tokens: 500000
X-RateLimit-Remaining-Tokens: 498412

Exceeding a limit returns 429 with a Retry-After header giving the seconds until the window resets:

{
  "error": {
    "message": "Rate limit exceeded: 300 requests per minute.",
    "type": "rate_limit_error",
    "code": "rate_limit_exceeded"
  }
}

Your current limits and live usage are shown under Dashboard → Usage → Rate Limits.

Error format#

All errors use the same envelope, matching OpenAI's shape:

{
  "error": {
    "message": "Human-readable description",
    "type": "invalid_request_error",
    "code": "model_not_found",
    "param": "model"
  }
}