Authentication
The CoinBoss API is public. You do not need an account or an API key to call any data endpoint.
No key required
Call any endpoint in the catalog with a plain HTTPS GET. Anonymous requests are limited per IP address: 1200 requests per minute.
curl -s "https://www.coinboss.com/api/sd/oi?coin=BTC"Optional API key
If several of your services share one IP address, or you call from a network whose address changes, you can create a key in your account and send it in the CB-API-KEY header. A request with a valid key is counted against the key instead of the IP address.
- Keys are created and revoked on the API keys page of your account. A verified email address is required.
- The full key is displayed once, at creation. Only a hash is stored, so it cannot be shown again.
- Each account can hold up to five active keys.
- An unknown or revoked key is ignored: the request is served as anonymous and counted against the IP address.
Request with a key
curl -s "https://www.coinboss.com/api/sd/oi?coin=BTC" \
-H "CB-API-KEY: $COINBOSS_API_KEY"Rate limit tiers
All tiers return the same data. During the current free period anonymous traffic and every key are served at the highest tier.
| Tier | Requests per minute | |
|---|---|---|
| hobbyist | 30 | |
| startup | 80 | |
| standard | 300 | |
| professional | 1200 | current for everyone |
Keeping keys safe
- Treat a key like a password. Keep it in an environment variable or a secret store, not in source code.
- Do not embed a key in a web page, a browser extension or a mobile app. Anything shipped to a client can be read by its users. Call the API from your server, or call it anonymously from the browser.
- Revoke a key as soon as you suspect it has leaked and create a new one.
- CoinBoss never asks for exchange API keys. The data is collected from public exchange endpoints, and no exchange credential is needed or accepted by this API.
Calling from a browser
Responses include Access-Control-Allow-Origin: *, so data endpoints can be called from any web origin. The X-Request-Id, X-Cache and X-RateLimit-* headers are exposed to scripts.
Account endpoints
Endpoints under /api/user and /api/auth belong to the signed-in website experience (watchlists, preferences, key management). They use the site's session, are not part of the public data API and are not listed in the catalog.