API Authentication

Authenticate your requests to the Cookiewise API using API keys.

Overview

The Cookiewise API uses API keys for authentication. You can generate and manage your API keys from the Settings page in your dashboard.

Generating an API Key

1. Log in to your Cookiewise dashboard
2. Navigate to Settings → API Keys
3. Click Generate New Key
4. Copy and securely store your key — it will only be shown once. New keys use the prefix cw_live_. Existing 64-character hex keys continue to work.

Using Your API Key

Include your API key in the Authorization header of every request. Keys are hashed at rest (SHA-256). Session cookies still authenticate the dashboard; plugins and servers should use Bearer tokens only.

Example Request

curl -X GET https://www.cookiewise.net/api/websites \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Permissions

Each key stores a JSON permissions list. New keys default to ["read","write"].

• read — GET requests
• write — POST, PUT, PATCH, DELETE (also implies read)

A key without the required permission receives 403 with {"error":"Insufficient API key permissions"}.

Rate Limits

API key requests are limited to 100 requests per minute per key. Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. When limited, the body is {"error":"Too many requests. Please try again later."} with Retry-After.

Login and other public auth routes use separate IP limits (for example 10 login attempts per minute).

Error Responses

If authentication fails, you'll receive a 401 Unauthorized response:

{ "error": "Authentication required" }