CargoLabs Docs

Create a key

Sign in to the developer portal.
Open API Keys and choose Create key. Give it a name and description that will make sense to a teammate a year from now.
Optionally attach an insurance agent and a platform fee. These control which products a key can quote and what surcharge is added at checkout for sales attributed to the key.
Copy the key. It is shown once. If you lose it, rotate it.

Send it

curl https://api.coverport.io/api/v1/products \
  -H "x-api-key: $COVERPORT_API_KEY" \
  -H "Content-Type: application/json"

const res = await fetch('https://api.coverport.io/api/v1/bundles', {
  headers: { 'x-api-key': process.env.COVERPORT_API_KEY! },
});
const body = await res.json();
if (!body.success) throw new Error(`${body.error.code}: ${body.error.message}`);

What a rejected key looks like

A missing or unknown key is rejected at the gateway before it reaches the API, so the response is not in the usual envelope:

HTTP/1.1 403 Forbidden
Content-Type: application/json

{ "message": "Forbidden" }

A key that was frozen or deleted in the portal is rejected the same way.

Rotate, freeze, delete

All three are in the portal under API Keys.

Rotate issues a new value and keeps the old one working for a grace period so you can deploy the new value without downtime. The old value's expiry is shown in the portal.
Freeze stops a key immediately and reversibly. Use it if you suspect a leak and want to investigate.
Delete revokes the key permanently.

Keep it server-side

An API key is a secret. Never ship it in a browser bundle, a mobile app, or a public repository. For anything that runs on an end user's device, use the SDK with a publishable key instead.

Rate limits

Keys are rate limited at the gateway. Sustained bursts above roughly 100 requests per minute return 429 with a Retry-After header. Back off and retry.

Authentication