Authentication

Secure access to the CodePlanet API.

API Keys

API keys are used to authenticate programmatic requests.

Getting Your Key

1. Go to Settings → API Keys
2. Click Generate New Key
3. Copy and save securely

⚠️ Keys are shown once. Store them safely!

Using Your Key

Include in the Authorization header:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://codeplanet.dev/api/v1/problems

Key Permissions

API keys have full access to:

• Your profile data
• Your progress
• Problem data
• Leaderboard

They cannot:

• Change your password
• Delete your account
• Access other users' private data

Session Authentication

For browser-based apps, use session cookies:

// After login, cookies are set automatically
fetch('/api/v1/user/profile', {
  credentials: 'include'
})

OAuth

We're working on OAuth support for third-party apps:

• Authorization Code flow
• PKCE support
• Scoped permissions

Security Best Practices

Do's ✅

• Store keys in environment variables
• Use HTTPS always
• Rotate keys periodically
• Use minimal permissions

Don'ts ❌

• Commit keys to git
• Share keys publicly
• Use keys in frontend code
• Log keys in errors

Revoking Keys

If a key is compromised:

1. Go to Settings → API Keys
2. Find the key
3. Click Revoke
4. Generate a new key

Revoked keys stop working immediately.

Rate Limiting

API keys are subject to rate limits:

See Rate Limits for details.

Error Codes

Webhook Authentication (Planned)

For webhooks, we'll provide:

• Signature verification
• Timestamp validation
• Retry handling

Generate your key: API Keys