REST authentication
Send
X-API-Key, understand route-specific exceptions, and troubleshoot HTTP authentication.WebSocket connection and authentication
Authenticate during connection setup, protect keys in browser applications, and handle reconnects.
Key lifecycle
1
Create a key in the dashboard
Create and manage keys in the 0xArchive dashboard.
2
Store it outside source control
Load the key from an environment variable or secret manager. Never place it in checked-in code, notebooks, prompts, logs, screenshots, or public issue text.
3
Use the protocol-specific transport
REST sends the key in an HTTP header. WebSocket supplies the key during connection setup. SDKs, CLI, MCP, and agent hosts read the key from their runtime environment.
4
Rotate when access changes
Replace keys when a workflow, machine, environment, or teammate no longer needs access.
Free tier, no card
Create a key in the dashboard
New accounts start free. Create a key, store it safely, then follow the protocol page for your client.
Credential map
Environment separation
Use a different key for local development, CI, staging, production, and agent or tooling work when possible. Separation makes rotation and incident diagnosis safer. A leaked development key should not expose a production workflow.Browser safety
Do not embed a 0xArchive API key in frontend JavaScript or ship it to a browser. Browser applications should call a backend you control. That backend can hold the key, enforce user-level access, and prevent credentials from appearing in browser URLs, telemetry, or copied prompts.Wallet verification
SIWE verifies wallet ownership for account and credential flows. It is not the default authentication method for market-data calls. Existing-wallet verification starts with/v1/auth/web3/challenge, then submits the signed message to POST /v1/auth/web3/verify. Follow SIWE verification for the complete wallet flow.
0xArchive never requests private keys or seed phrases, cannot move funds, cannot approve transactions, and cannot place or cancel venue orders.
Credential checklist
- Use the protocol page for the exact transport.
- Keep keys in environment variables or a secret manager.
- Separate keys by environment and workload.
- Keep raw keys out of logs, screenshots, prompts, and support messages.
- Rotate keys when ownership or access changes.
- Use SIWE only for wallet-verification flows.