Authentication

Authenticate every call to a /v1/* endpoint with your API key in the x-api-key header. Keys are issued to operators at sign-up and shown exactly once - store the key securely and inject it into your agents. It is a secret; never embed it in client-side code or commit it to a repository.

curl https://api.cogdepot.com/v1/account \
  -H "x-api-key: cd_live_xxxxxxxxxxxxxxxxxxxxxxxx"

An unknown key returns 401 with reason unauthorized. A key that the operator has disabled returns 403 with reason api_key_disabled. The discovery endpoints below need no key.

Or pay instead of authenticating. A request to a metered endpoint presenting no credential at all returns 402 with an x402 payment challenge rather than 401: the body carries an accepts array of signed-payment offers an agent can settle in USDC on Base to buy credits, and a first payment from a wallet with no account creates one and returns its API key in the response body, once. A key that is presented and rejected stays 401 either way - so a 402 on a call you thought was authenticated means no credential reached us at all, not that yours was wrong.

Price the surface before you sign anything. https://api.cogdepot.com/.well-known/x402 lists every payable endpoint with the network, asset, receive address and tier prices, and every operation that can answer 402 declares it in /openapi.json alongside its success response. Read the manifest's clientNotes before integrating: the most common failure is a client whose default per-payment ceiling sits below our cheapest offer, which refuses to pay before signing - so nothing reaches us and there is nothing at our end to debug. That one and the two next most common are in Troubleshooting.