Authenticate your requests

Send your API key in the Authorization header on every request. Each environment has its own key and host.

Step 1: Create a key

1. Log in to your environment's portal.
2. Open Profile → Account Settings → Partner API Keys.
3. Create a key and store it in your secret manager.

No portal login? Request one.

Step 2: Send the key

This call lists your accounts. A 200 proves the key works, even with an empty list.

curl -s "https://sandbox-api.coris.ai/api/v0_2/accounts/?limit=1" \
  -H "Authorization: Token YOUR_API_KEY"

import requests

response = requests.get(
    "https://sandbox-api.coris.ai/api/v0_2/accounts/",
    params={"limit": 1},
    headers={"Authorization": "Token YOUR_API_KEY"},
)
print(response.status_code, response.json())

const response = await fetch(
  "https://sandbox-api.coris.ai/api/v0_2/accounts/?limit=1",
  { headers: { Authorization: "Token YOUR_API_KEY" } },
);
console.log(response.status, await response.json());

Try GET /accounts/ in the API explorer.

Send each key to its own host:

What to do next

A missing or rejected key returns 401. Quote the correlation_id from detail, or the Correlation-ID response header, when you contact support.

{
  "detail": "Invalid Authorization header. No credentials provided. correlation_id: 9f2c6b1e40a74c138d527ae1f03b6c28"
}

For key rotation, revocation and the other API controls, see Security and compliance.

FAQ

Can I limit what a key can reach?

Yes, to named ISOs. See Limit what a key can reach.

Can I call the API from a browser?

No. A browser exposes your key to every user. Call Coris from your server.

Should I use Token or Bearer?

Use Token. The API also accepts Bearer today, but Token is the documented form.

Next: Test in the sandbox