API Keys, Scopes, and the Prepaid USD Wallet Explained
Managing API keys, scopes, and a prepaid USD wallet is essential for a stable, cost‑controlled computer use agent. You need to read your key safely from an environment variable, apply the right scopes for your resources, and stay within a prepaid wallet where 1 credit equals $0.01. This guide shows exactly how it works and how to handle webhooks and retries safely.
How API keys and scopes work
Coasty uses an API key for authentication. Read the key from the COASTY_API_KEY environment variable. In requests, provide the key via either X-API-Key: <key> or Authorization: Bearer <key>. Scopes gate access to specific resources. The docs at https://coasty.ai/developers/keys explain available scopes.
# Install curl if needed
# macOS: brew install curl
# Linux: sudo apt-get install curl
# Set the key from the env var and call a public endpoint
KEY=$(cat /dev/stdin <<< "$COASTY_API_KEY")
# Example: list runs (requires a key with runs scope)
curl -sS https://coasty.ai/v1/runs \
-H "X-API-Key: ${KEY}" \
-H "Content-Type: application/json"Prepaid USD wallet and credit pricing
- ●Wallet is prepaid in USD. 1 credit equals $0.01.
- ●Charges are deducted after each valid request or agent step.
- ●When credits run low, requests return 402 INSUFFICIENT_CREDITS.
- ●For Tasks and Workflows, each agent step bills $0.05 per agent step.
- ●You can view your wallet balance and transaction history through the dashboard linked from https://coasty.ai/developers/keys.
Read COASTY_API_KEY from the environment and always check for 402 INSUFFICIENT_CREDITS before retrying.
Secure webhooks with HMAC signatures
Your webhook_url must receive signed payloads. Coasty includes the header Coasty-Signature: t=unix,v1=hex. The t value is the request timestamp (seconds since epoch), and v1 is an HMAC signature using your API key. Verify this signature to confirm the request is genuine and not replayed.
Idempotency for writes
To make writes safe for retries, use the Idempotency-Key header. Coasty treats requests with the same idempotency key as idempotent, preventing duplicate processing. This is useful for workflows and runs where network issues might cause retries.
Where seeing and acting beats brittle selectors
Many automation tools rely on brittle selectors like CSS classes, IDs, or XPath strings that break when UI changes. A computer use agent on Coasty sees the screen, interprets instructions, and clicks or types like a real user. This approach is resilient to layout shifts and automation‑specific selectors, giving you a more reliable computer use agent.
Now you know how to read COASTY_API_KEY, use scopes, manage a prepaid USD wallet where 1 credit = $0.01, verify webhook signatures, and apply idempotency for writes. Start building a secure, cost‑controlled computer use agent. Get your API key at https://coasty.ai/developers .