Production behavior, without the guesswork.

Send the complete key in the X-API-Key header. CodeCobra stores a SHA-256 hash rather than the recoverable key and compares the submitted value against that hash. A missing, invalid, deleted, or revoked key returns HTTP 401.

No. Each key is scoped to the API product for which it was issued. Using a valid key against a different product returns HTTP 401. This separation limits the impact of accidental key exposure.

Only successful API operations deduct the configured 1 credit. Parameter validation failures, authentication failures, exhausted balances, throttled requests, disabled APIs, and balance checks do not deduct usage.

The key record is locked inside a database transaction before its balance is checked and updated. This prevents concurrent requests from independently spending the same final credits.

Send GET /api/v1/balance/ with the same X-API-Key header. The JSON response includes the API name, key status, credits remaining, per-minute limit, and daily limit.

CodeCobra evaluates successful requests recorded during the previous minute and previous 24 hours. When either configured threshold is reached, the API returns HTTP 429 with rate_limited. The rejected call does not consume credits.

Retry HTTP 429 and temporary HTTP 503 responses with exponential backoff and jitter. Do not automatically retry HTTP 400, 401, or 402 until the parameters, key, or balance has been corrected. A retry that succeeds is a new operation and consumes credits.

API and error responses use JSON. Successful responses include the generated product-specific fields plus credits_remaining. Error responses include a human-readable error value and, where applicable, a stable machine-readable code.

The product disappears from the public marketplace and its endpoint returns HTTP 503 with api_unavailable. Existing keys and balances remain stored so service can resume without issuing replacements.

Use a secret manager or server-side environment variable. Never include a key in a URL, browser bundle, mobile application binary, public repository, analytics event, exception message, or support ticket.

No. The full key is shown once at issuance and is not stored reversibly. The operator can identify and disable a key by its safe prefix and final characters, but cannot retrieve the secret value.

Nothing about the integration. Free and paid keys use the same endpoint, authentication header, response schema, limits, balance endpoint, and error behavior. The free tier is limited to one issuance per email address and API.