6 min read · 2026-09-18
# no key — HTTPS JSON, same results as the website❯ curl https://claudecookie.com/api/v1/health{ "ok": true }❯ curl https://claudecookie.com/api/v1/check -d '{"cookie":"…"}'{ "ok": true, "planLabel": "Claude Pro", "session": { "percent": 12 } }
Check a Claude session
POST { "cookie" } or a batch { "cookies": ["…"] } of at most 10. The response is the same public shape as the website: ok, plan, email, and the 5-hour and weekly windows — never extras, never the cookie. A paste without sessionKey or sessionKeyV3 is not stored.
curl https://claudecookie.com/api/v1/check \
-H 'Content-Type: application/json' \
-d '{"cookie":"sessionKey=sk-ant-sid01-…"}'Mint credentials.json
POST { "cookie" } for a single set. The server checks the session, then runs the Claude Code OAuth convert. A failed check returns 200 with invalidReason and does not write a credential row. OAuth tokens are returned to you and are not stored. Free accounts cannot mint.
curl https://claudecookie.com/api/v1/credential \
-H 'Content-Type: application/json' \
-d '{"cookie":"sessionKey=sk-ant-sid01-…"}'Health
GET returns { "ok": true }. Use it to see that the ingest process is up. It does not expose internals.
curl https://claudecookie.com/api/v1/healthRate limits
Nginx caps the whole /api/v1/ prefix at 10 requests per second. The ingest process then applies the same per-IP budgets as the website for check and credential, so one address cannot double its allowance by using both surfaces.
| Route | Budget |
|---|---|
| All /api/v1/* | 10 requests per second per IP, burst 20 |
| POST /api/v1/convert | 60 requests per minute per IP |
| POST /api/v1/check | 20 requests per minute per IP, shared with the website |
| POST /api/v1/credential | 5 per minute and 20 per hour per IP; 3 per hour per sessionKey |
invalidReason values
Errors use HTTP 400, 403 or 429 plus { "ok": false, "invalidReason" }. 429 includes Retry-After in seconds.
| Code | Meaning |
|---|---|
| empty | Missing or blank paste. |
| unknown_format | Convert could not detect a cookie format. |
| bad_target | target is not one of the five supported formats. |
| missing_session | No sessionKey or sessionKeyV3 in the paste. |
| rate_limited | This IP or sessionKey hit a published budget. |
| unreachable | Claude did not answer, or no safe egress proxy is available. |
| expired | Claude rejected the session. |
| reauth | Claude wants a fresh browser login before minting tokens. |
| no_plan | The account has no Pro or Max plan. |
| too_large | The body is larger than the 512 KB ingest limit. |
API questions
No. The v1 routes are public. Abuse is handled with the rate limits on this page. If that is not enough later, keys would be a separate change.
On the website, yes. On POST /api/v1/convert the paste is sent to this site over HTTPS and parsed on the server. Use the web converter when you do not want the paste to leave the device.
Yes. Check and credential use the same warehouse as the pages. Convert writes one event per successful set, then may run a quiet background check on that set. Empty pastes and missing sessionKey are not stored.
No. Credential is one cookie set per request. Check accepts up to 10 sets. Convert accepts up to 40 sets in one paste.
Claude can accept a session for usage and still refuse to mint OAuth tokens until you sign in again in the browser. Export a cookie from that fresh login.
Prefer the website tools?
The check page runs the same session read, with the paste encrypted in the browser first.