X-API-Key request header. Each native endpoint page states whether the route requires the key, is public, uses wallet-signature verification, or uses an x402 payment flow.
string
required
API key created in the 0xArchive dashboard and loaded from your runtime environment.
Authenticated request
meta.request_id or the x-request-id response header when troubleshooting.
Missing or invalid key
A missing or invalid key normally returns HTTP401. Treat the status as the control signal and the compact JSON body as the debugging payload.
x-request-id response header when meta.request_id is absent. See Errors and request IDs for logging and retry behavior.
Route-specific exceptions
GET /health is public and checks service reachability only. It does not verify an API key. Other exceptions are marked on their endpoint pages and in the OpenAPI security declaration. Do not assume a route inherits the default authentication rule when its operation-level security says otherwise.
SIWE challenge, verification, and API-key management routes use wallet-signature verification instead of the normal market-data API-key check. Follow the route-specific endpoint page and SIWE verification. Never send a private key or seed phrase.
POST /v1/web3/subscribe is an x402 payment flow, not SIWE verification. Send the signed payment-signature header required by its endpoint page and follow wallet access and x402.
These account and payment flows do not replace X-API-Key on authenticated market-data endpoints.
First authentication check
1
Load the key from the environment
Use
OXARCHIVE_API_KEY in REST examples. Do not paste the raw key into source code.2
Call one small authenticated route
Use a bounded request such as the one-level BTC order-book example above.
3
Inspect the exact failure
On
401, compare the header name, key source, JSON error code, and request identifier before retrying.4
Keep retries bounded
Fix authentication before retrying. Repeating the same unauthorized request does not repair the key.
Shared request rules
Rate limits and credits
Plan request volume, concurrency, and retry behavior.
Responses
Parse HTTP statuses and response bodies correctly.
Errors and request IDs
Keep request identifiers and decide when to retry or stop.
Related guidance
API keys and credential safety
Create, store, separate, and rotate credentials safely.
Endpoint reference
Find the route, parameters, authentication state, and response schema.