CostLoop API Documentation

Developer docs

Connect CostLoop with ChatGPT, dashboards, and internal tools

Use a CostLoop API key to let approved tools read your subscription list, recurring spend totals, and department-level software costs. The OpenAPI schema is ready to import into ChatGPT Actions.

Quick setup

Use CostLoop with ChatGPT Actions

In the GPT action editor, CostLoop users should choose API key authentication, click the gear beside the Authentication field, select Bearer, paste only their CostLoop API key, import the schema URL below, and use the CostLoop privacy policy URL. ChatGPT creates the required authorization header automatically.

Authentication

API Key → Bearer

Schema URL

Import from URL

Privacy policy

Required for public GPTs

Values to enter

Schema URL

https://costloop.app/openapi.json

Privacy policy URL

https://costloop.app/privacy-policy/

API key field

YOUR_COSTLOOP_API_KEY

Create a CostLoop API key. In CostLoop, go to Settings, open the API section, create a key, and copy it immediately. Keys are shown only once.

Add an action in your GPT. Choose API Key authentication, click the gear beside the Authentication field, select Bearer, and paste only the CostLoop key, such as cl_live_.... Save the authentication settings before you test the action.

Import the schema. Click Import from URL and enter https://costloop.app/openapi.json.

Add the privacy policy. Enter https://costloop.app/privacy-policy/, then test the detected actions.

Update the GPT. If the editor shows Updates pending, click Update so the action becomes available in the preview chat.

If Test says the Authorization header is missing: the schema imported correctly, but the GPT action is not attaching the saved credential. Selecting API Key in the visible dropdown is not enough. Click the gear beside Authentication, confirm Bearer is selected, paste only the CostLoop API key, save the authentication settings, and run Test again.

If you imported the schema before saving authentication: save the Bearer API key settings first, then click Import from URL again so ChatGPT re-reads the authenticated actions from https://costloop.app/openapi.json.

If the API key is saved as hidden but Test still says the header is missing: delete that GPT action and create a new one, then set Authentication first, import the schema URL again, add the privacy policy URL, save, and click Update. This clears older action settings that ChatGPT may have cached.

If Preview says the tool is not available: the action has not been applied to the GPT yet. Click Update in the top-right of the GPT editor, then retry the preview or start a fresh chat with the updated GPT.

Authentication with API keys

CostLoop API keys are workspace-scoped. Treat them like passwords: store them in the external tool’s secret field, never paste them into a public prompt, and revoke old keys from CostLoop settings if they are no longer needed.

curl https://app.costloop.app/api/v1/subscriptions \
  -H "Authorization: Bearer YOUR_COSTLOOP_API_KEY"

OpenAPI schema

Use the schema when a tool asks for an OpenAPI specification. It describes the CostLoop read endpoints in a format ChatGPT Actions and other API clients can understand.

View the CostLoop OpenAPI schema

Available endpoints

GET
/api/v1/subscriptions

List subscriptions available to the workspace connected to the API key.

GET
/api/v1/spend

Get normalized monthly and annual software spend totals.

GET
/api/v1/departments

Get department-level spend and subscription counts.

Base URL: https://app.costloop.app

Webhooks

Business plan users can create webhook endpoints in CostLoop settings. Webhooks send real-time POST notifications to your endpoint when selected subscription or request events happen.

Supported events

  • subscription.created
  • subscription.updated
  • subscription.deleted
  • request.approved
  • request.declined
app.post('/webhooks/costloop', (req, res) => {
  // Verify the signing secret you saved when creating the endpoint.
  // Then route the event by req.body.type.
  res.sendStatus(200)
})

Security and privacy notes

  • Use separate API keys for separate tools so each integration can be revoked independently.
  • Only add API keys to tools you trust with your subscription and spend data.
  • Do not paste an API key into a public GPT instruction, public repository, or shared document.
  • Revoke keys immediately if a tool is no longer used or a secret may have been exposed.

For product security details, see Security. For data handling, see the Privacy Policy.