---
title: "Coverage Cat Auth and API Keys"
description: "Coverage Cat auth docs covering OTP requests, key confirmation, rotation, and where delegated umbrella and homeowners flows require operator keys."
canonical: "https://www.coveragecat.com/developers/auth"
last-updated: "2026-08-18"
---

# Coverage Cat Auth and API Keys

## Coverage Cat auth model

Coverage Cat exposes both public and authenticated surfaces:

- Public: `/api/agent`, `/api/agent/openapi.yaml`, `/openapi.json`, `/ai/skills`, the runtime markdown skills, and the developer portal.
- Authenticated: delegated umbrella purchase endpoints and delegated homeowners quote endpoints.

## OTP setup flow

Use the operator or integrator email, never the end-customer email.

```sh
curl -X POST https://www.coveragecat.com/api/agent/key/request   -H "Content-Type: application/json"   -d '{"email":"you@yourco.com"}'
```

Then confirm the code and receive the key:

```sh
curl -X POST https://www.coveragecat.com/api/agent/key/confirm   -H "Content-Type: application/json"   -d '{"email":"you@yourco.com","otp":"123456"}'
```

Rotate with the existing bearer key:

```sh
curl -X POST https://www.coveragecat.com/api/agent/key/rotate   -H "Authorization: Bearer ccop_..."
```

## Where Coverage Cat requires bearer auth

- `POST /api/agent/umbrella/draft`
- `POST /api/agent/umbrella/quotes`
- `POST /api/agent/umbrella/select`
- `POST /api/agent/umbrella/bind`
- `POST /api/agent/umbrella/status`
- `POST /api/agent/umbrella/attach`
- `POST /api/agent/homeowners/quotes`
- `GET /api/agent/homeowners/dashboard`
- `POST /api/agent/homeowners/dashboard/session`
- `POST /api/agent/homeowners/fix-issues-email`

## Coverage Cat auth guardrails

- Store the issued key in a server-side secret manager.
- Do not embed the key in browser code or customer-visible prompts.
- Do not use shared environment keys where Coverage Cat explicitly requires operator-issued keys.
- Read the homeowners operator setup guide before you issue a live key: `/ai/skills/homeowners/setup`.