---
title: "Coverage Cat Get API Key"
description: "Coverage Cat key setup guide covering the operator OTP flow, OAuth alternatives, storage guardrails, and sandbox-first rollout advice."
canonical: "https://www.coveragecat.com/developers/get-api-key"
last-updated: "2026-08-25"
---

# Coverage Cat Get API Key

## 1. Pick the right auth path

Coverage Cat supports two main operator-auth paths:

- Standard OAuth browser flow for hosts that already support authorization-code + PKCE.
- OTP compatibility flow for humans or teams who need a reusable operator key.

Read `/developers/auth` first if you need the full protocol details.

## 2. Request the OTP with your operator email

Use your operator or integration email, never the end-customer email.

```sh
curl -X POST https://www.coveragecat.com/api/agent/key/request   -H "Content-Type: application/json"   -d '{"email":"you@yourco.com"}'
```

Coverage Cat also documents the full operator setup flow at `/ai/skills/homeowners/setup`.

## 3. Confirm the code and receive the key

```sh
curl -X POST https://www.coveragecat.com/api/agent/key/confirm   -H "Content-Type: application/json"   -d '{"email":"you@yourco.com","otp":"123456"}'
```

Rotate later with your existing bearer key:

```sh
curl -X POST https://www.coveragecat.com/api/agent/key/rotate   -H "Authorization: Bearer ccop_..."
```

## 4. Store the key server-side

- Store the issued key in a server-side secret manager.
- Do not embed it in browser code, mobile apps, or customer-visible prompts.
- Reuse the same operator key across many customers, but set each customer's real email on their own intake.

## 5. Rehearse in sandbox before live traffic

Coverage Cat publishes sandbox guidance at `/developers/sandbox`:

- Homeowners browser sandbox: `/intake?ltp=owned_homes&sandbox=homeowners`
- Delegated homeowners API sandbox: `sandbox: true` only on the first create call
- Delegated umbrella API sandbox: `sandbox: true` only on the first draft call

## 6. Browser note

This page is intentionally human-readable. The OTP endpoints themselves are still JSON API routes:

- `POST /api/agent/key/request`
- `POST /api/agent/key/confirm`
- `POST /api/agent/key/rotate`

If you want the standard browser-based flow instead of a reusable operator key, start with `/auth.md` and `/oauth2/authorize`.