Authentication and rate limits

​

API keys

curl https://codzen.ai/api/v1/balance \
  -H "Authorization: Bearer $CODZEN_API_KEY"

• Create API keys in the console. An API key starts with cz_. Give each key a name, such as the app or environment that uses it; an account can have up to 10 API keys.
• The full key is shown only once, when you create it. Codzen stores only a hash, so a lost key cannot be shown again: create a new one and revoke the old one.
• Revoking a key in the console removes it for good. Requests with a revoked key fail with 401 invalid_api_key.
• API keys do not expire, and every key can call every endpoint for its account.

​

Authentication errors

​

Rate limits

• Every request with an API key counts toward its rate limit, including GET requests that poll a generation.
• The concurrency limit is per account, across all of its API keys. A generation stops counting once it succeeds or fails.
• The API does not queue for you. A request over a limit fails right away with 429 and a Retry-After header: the number of seconds to wait before trying again.
• Responses carry no X-RateLimit-* headers. Rely on 429 and Retry-After.

async function codzen(path, init = {}) {
  for (;;) {
    const res = await fetch(`https://codzen.ai/api/v1${path}`, {
      ...init,
      headers: {
        Authorization: `Bearer ${process.env.CODZEN_API_KEY}`,
        'Content-Type': 'application/json',
        ...init.headers,
      },
    });
    if (res.status !== 429) return res;
    const seconds = Number(res.headers.get('Retry-After') ?? 1);
    await new Promise((resolve) => setTimeout(resolve, seconds * 1000));
  }
}

​

Request IDs