---
title: "Auth and Rate Limits"
description: "How Coverage Cat issues bearer keys, when operator authentication is required, and what rate limits apply to the public agent surface."
canonical: "https://www.coveragecat.com/ai/auth-and-rate-limits"
last-updated: "2026-08-13"
---

# Auth and Rate Limits

Coverage Cat's public agent surface uses bearer authentication, but not every flow uses the same key requirements.

## Key issuance

- `POST /api/agent/key/request` sends a 6-digit OTP to the operator email.
- `POST /api/agent/key/confirm` exchanges the OTP for a bearer token.
- `POST /api/agent/key/rotate` rotates the active token and invalidates the old one.

## Which flows need which key

- Delegated umbrella purchase uses a bearer key.
- Delegated homeowners quotes require an **operator-issued** bearer key.
- Direct homeowner handoff to [Coverage Cat intake](https://www.coveragecat.com/intake) does not require an operator key.

## Rate limits

The public discovery document advertises two baseline limits:

- authenticated operator traffic: 30 requests per minute
- IP fallback traffic: 8 requests per minute

Build retries with backoff, avoid guessing endpoint names, and start from the discovery document or OpenAPI map instead of probing the API surface.

## Recovery and operational notes

- Store keys in a secret manager and distribute them to runtime agents out of band.
- Rotate keys proactively before expiry.
- Use a real operator or integrator email for key issuance, never a customer's intake email.

## Next steps

- **Learn:** Read [What Coverage Cat does](/what-we-do), browse [insurance guides](/insurance-types), or scan the [FAQ](/faq).
- **Estimate:** Use the [home insurance calculator](/tools/home), [umbrella insurance calculator](/tools/umbrella), or [carrier price comparison](/tools/auto-estimates).
- **Compare:** Start a [Coverage Cat quote comparison](https://www.coveragecat.com/intake) when you want licensed broker help and real quotes.
- **Integrate:** Explore the [Coverage Cat Agent API hub](/ai/skills), the [discovery document](/api/agent), and the [OpenAPI spec](/api/agent/openapi.yaml).