What is the primary authentication method for Code::Stats?

Code::Stats primarily uses API keys for authentication. These keys are unique to each user and act as a bearer token to authorize data submissions.

How do I get my Code::Stats API key?

You can obtain your API key by logging into your Code::Stats account on the website and navigating to your profile or settings section, where the key is displayed.

Can I use OAuth 2.0 with Code::Stats?

No, Code::Stats does not support OAuth 2.0. Its authentication model is based on direct API key usage for simplicity in editor plugins and custom scripts.

Where should I include my API key in an API request?

Your API key should be included in the 'Authorization' HTTP header as a Bearer token (e.g., 'Authorization: Bearer YOUR_API_KEY').

Is it safe to hardcode my API key in my code?

No, it is not safe to hardcode your API key. Best practices recommend storing it in environment variables or secure configuration files and never committing it to version control.

How often should I regenerate my Code::Stats API key?

Code::Stats does not enforce a regeneration policy, but it's a good security practice to regenerate your key if you suspect it has been compromised or if you handle sensitive integrations.

Do I need to use HTTPS for Code::Stats API calls?

Yes, always use HTTPS for all API calls to Code::Stats to ensure your API key and data are encrypted and protected during transit.

Code::Stats Authentication: API Key Setup & Security (2026)

Authentication overview

Code::Stats uses a straightforward authentication model centered around personal API keys. This approach is designed to simplify integration for editor plugins and custom scripts, allowing users to submit their coding activity data securely to their Code::Stats profile. The API key serves as a bearer token, identifying the user and authorizing data submission without requiring full login credentials for each interaction. This method prioritizes ease of use for developers while maintaining a clear and auditable link between submitted data and the originating user account. The official Code::Stats API documentation provides further details on API endpoints and data formats.

The service's focus on individual coding statistics means that authentication is primarily a client-side concern, where the client (e.g., an editor plugin or a custom script) needs to prove its identity to the Code::Stats server. This differs from more complex OAuth 2.0 flows often seen in third-party service integrations, as Code::Stats is designed for direct user interaction and data submission rather than delegated authorization for other applications. For a general understanding of API key security, the Cloudflare API keys guide offers relevant context on their use cases and management.

Supported authentication methods

Code::Stats primarily supports a single authentication method for its API: API keys. These keys are unique to each user and are generated through the Code::Stats web interface. When making requests to the Code::Stats API, this key is included in the request headers to authenticate the sender.

Method	When to Use	Security Level
API Key (Bearer Token)	For editor plugins, custom scripts, and direct API calls to submit coding activity.	Moderate. Requires careful handling to prevent unauthorized access.

This method is suitable for the service's architecture, which involves frequent, small data submissions from individual developer environments. It avoids the overhead of more complex authentication protocols while providing sufficient security for the type of data being transmitted. The Code::Stats documentation details how to structure API requests using your personal key.

Getting your credentials

To obtain your Code::Stats API key, follow these steps:

Create an Account: If you don't already have one, register for a free account on the Code::Stats website.
Log In: Access your Code::Stats account using your username and password.
Navigate to Settings: Once logged in, look for your user profile or settings section.
Locate API Key: Within your settings, there will be a specific section dedicated to your API key. This key is typically displayed as a long string of alphanumeric characters.
Copy the Key: Copy your unique API key. It is crucial to treat this key as a sensitive password, as anyone with access to it can submit data on your behalf.

The official Code::Stats user guide provides visual instructions for navigating your account settings to retrieve your API key. It is recommended to generate a new key if you suspect your current one has been compromised.

Authenticated request example

When using the Code::Stats API, your API key is typically sent in the Authorization header as a Bearer token. This is a common pattern for API key authentication across many services. The specific endpoint for submitting data is usually /api/v1/custom, as documented in the Code::Stats API reference.

Here's an example of how to make an authenticated request using curl, which demonstrates the header structure:

curl -X POST \
  https://codestats.net/api/v1/custom \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "language": "Python", "xps": [ { "file": "main.py", "xp": 10 } ] }'

Replace YOUR_API_KEY with the actual API key obtained from your Code::Stats account. The -d flag in the curl command is used to send the JSON payload containing the coding activity data, including the language and experience points (XPs) gained for specific files. For integrations with specific programming languages, Code::Stats provides SDKs for Python, Go, JavaScript, Ruby, PHP, and Rust, which abstract away the direct HTTP request details and handle authentication internally.

Security best practices

Proper management of your Code::Stats API key is essential to maintain the integrity of your coding statistics and prevent unauthorized data submissions. Adhering to these security best practices can help protect your account:

Treat API Keys as Passwords: Your API key grants access to submit data to your account. Never share it publicly, commit it to version control systems like Git without proper encryption or exclusion, or embed it directly into client-side code that could be easily inspected.
Use Environment Variables: For custom scripts and development environments, store your API key in environment variables rather than hardcoding it into your source code. This keeps the key out of your codebase and makes it easier to manage across different environments.
Secure Storage: If storing the key on a server or local machine, ensure it is in a secure location with restricted access. Avoid storing it in plain text files.
Regenerate Keys Periodically: Some services recommend regenerating API keys periodically, especially if there's any suspicion of compromise. While Code::Stats does not enforce a specific rotation policy, it is a good practice if you handle sensitive data or integrate with many systems.
Monitor Account Activity: Regularly check your Code::Stats profile for unusual activity or unexpected data submissions. While Code::Stats is primarily for personal tracking, vigilance helps ensure your data accurately reflects your work.
HTTPS Only: Always ensure that all API requests to Code::Stats are made over HTTPS. This encrypts the communication channel, protecting your API key and data from interception during transit. The Mozilla Developer Network's guide on secure contexts emphasizes the importance of HTTPS for web security.
Restrict Access: If you are building an integration that runs on a shared system, ensure that only authorized processes or users have access to the API key.

By following these guidelines, you can significantly reduce the risk of unauthorized access or misuse of your Code::Stats account and maintain the accuracy of your tracked coding activity.