Authentication

Developer API keys

Create a developer API key from your CSFloat profile at csfloat.com/profile.

Send the key directly in the Authorization header. It is not a bearer token, so no scheme prefix is used.

Authorization: YOUR_API_KEY

Unauthenticated requests

Public routes accept requests without an Authorization header. Protected routes reject them with code 27:

{
  "code": 27,
  "message": "authorization not set"
}

Security schemes

• ApiKeyAuth sends the developer key in the Authorization header.
• An empty security array means the operation needs no credentials.