The Coder Copilot Developer API lets you call AI models directly using an API key. No session cookie required — just pass your key and a prompt.

Base URL

https://codercopilot.firesmasher.workers.dev

Authentication

All inference endpoints require your API key. Pass it as a query parameter or as an HTTP header.

Query parameter (easiest)

POST /v1/model/orbus-low?apikey=dak_your_key_here

Header

x-api-key: dak_your_key_here

Keys start with dak_ and are 52 characters long. You can create up to 3 keys per account on the API Keys page.

OAuth / Database Auth

Beyond per-key authentication, the server can enforce an additional layer of OAuth-style request authentication configured via require.jsonc stored in D1 (managed on the Database tab). When config.enableAuthentication is true, every inference request must pass the check defined by oauth.authenticationType — either "Key" or "Password".

When config.allowRequests is false, all inference requests are rejected with 503 regardless of auth.

Key method

Pass ?apikey= in the URL as usual, and include oauthKey and oauthType in the JSON body. The worker reads the stored 64-character key from D1 and compares.

POST /v1/model/orbus-low?apikey=dak_your_key
Content-Type: application/json

{
  "message": "Your prompt here",
  "oauthKey": "64-character-secret-key-here",
  "oauthType": "key"
}

oauthType must be the string "key" (case-insensitive). The oauthKey must exactly match the 64-character value set in oauth.oauthKey inside require.jsonc.

Password method

Pass the password as the ?pswd= query parameter. The worker fetches oauth.oauthPassword from D1 and compares.

POST /v1/model/orbus-low?apikey=dak_your_key&pswd=my_password

Available Models

Four models are available. They all draw from your single shared token pool — no model has its own individual budget. Pick the model that fits your task; the tokens you spend always come from the same 15,000-token account-level pool.

Token counts are approximate (≈ 1 token per 4 characters for input + output). All models return text only — file creation is not supported via the Dev API.

POST /v1/model/:model

Request body (JSON)

* Either message or prompt is required.

Example request

curl -X POST \
  "https://codercopilot.firesmasher.workers.dev/v1/model/orbus-low?apikey=dak_your_key" \
  -H "Content-Type: application/json" \
  -d '{"message": "What is a Cloudflare Worker?"}'

Example response (200 OK)

{
  "ok": true,
  "model": "orbus-low",
  "reply": "A Cloudflare Worker is a serverless JavaScript runtime…",
  "usage": {
    "tokensConsumed": 47,
    "tokensUsed": 47,
    "tokensRemaining": 14953,
    "tokensLimit": 15000
  }
}

Error responses

GET /v1/models

Example response

{
  "models": [
    { "slug": "flux-plus",     "msgsPerMinute": 10, "sharedPoolLimit": 15000, "sharedPoolResetH": 12 },
    { "slug": "orbus-low",     "msgsPerMinute": 10, "sharedPoolLimit": 15000, "sharedPoolResetH": 12 },
    { "slug": "nova-standard", "msgsPerMinute": 10, "sharedPoolLimit": 15000, "sharedPoolResetH": 12 },
    { "slug": "astra-plus",    "msgsPerMinute": 10, "sharedPoolLimit": 15000, "sharedPoolResetH": 12 }
  ],
  "pool": { "tokenLimit": 15000, "resetHours": 12 }
}

Key Management Endpoints

These endpoints require a valid session cookie (you must be logged in via the main Coder Copilot app), not an API key.

Database Config Endpoints

These endpoints read and write require.jsonc in D1. They require a valid session cookie — the same login session used by the Developer Portal. They are also accessible via the Database tab in the UI.

Example response

{
  "content": "{\n    \"config\": { ... },\n    \"oauth\": { ... }\n}"
}

Returns 404 if the config has never been saved to D1 yet.

Request body (JSON)

Example request

curl -X POST \
  "https://codercopilot.firesmasher.workers.dev/api/dev/db/config" \
  -H "Content-Type: application/json" \
  --cookie "cc_session=your_session_cookie" \
  -d '{
    "content": "{\n  \"config\": { \"allowRequests\": true, \"enableAuthentication\": false },\n  \"oauth\": { \"oauthPassword\": \"my_password\", \"oauthKey\": \"64-string\", \"authenticationType\": \"Key\" }\n}"
  }'

Example response (200 OK)

{ "ok": true }

Rate Limits

Token usage is tracked at the account level, not per key or per model. All your API keys and all models share one 15,000-token pool that resets every 12 hours. For example: Key A uses 120 tokens on orbus-low, and Key B uses 80 tokens on flux-plus — your pool now shows 200 tokens used, 14,800 remaining.

When you hit a limit, the API returns HTTP 429 with retryIn (seconds, for message rate limit) or resetInMinutes (for token pool exhaustion) in the response body.

Quick Start

JavaScript / fetch

const res = await fetch(
  "https://codercopilot.firesmasher.workers.dev/v1/model/orbus-low?apikey=dak_your_key",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ message: "Hello, what can you help me with?" }),
  }
);
const data = await res.json();
console.log(data.reply);       // AI response text
console.log(data.usage);       // token consumption details

Python

import requests

res = requests.post(
    "https://codercopilot.firesmasher.workers.dev/v1/model/orbus-low",
    params={"apikey": "dak_your_key"},
    json={"message": "Hello, what can you help me with?"}
)
data = res.json()
print(data["reply"])
print(data["usage"])