Authentication

All api.co.id APIs are authenticated with an API key sent in the x-api-co-id header.

The x-api-co-id header

Include this header in every request. Without it, the server returns 401.

Your API key

Stored only in this browser and used by Try it.

Authenticated request

curl -X GET "https://use.api.co.id/regional/indonesia/provinces" \  -H "x-api-co-id: $API_CO_ID_KEY"

Chat API

Chat API uses its own API key, sent as Authorization: Bearer <key>. See Chat API › Getting Started.

Keeping your API key safe

Keep your API key secret

Call api.co.id from your server, not from frontend code or mobile apps. Store the key in an environment variable and rotate it regularly.

Authentication errors

Status	Meaning	How to fix
401Unauthorized	Missing or invalid API key (e.g. User not authenticated).	Send the x-api-co-id header with an active key.
402Payment Required	Insufficient balance for a paid endpoint.	Top up in the Dashboard, then retry.