Skip to main content

​
The API key

Every /swap/* request authenticates with an API key in the x-api-key header:
Keys are shown once at creation; only a hash is stored server-side, so copy the plaintext when you mint it. A missing or invalid key returns 401 with a plain { "message": … } body. The same posture covers the signer key: the CLI keeps it in the OS keychain, encrypted at rest, and never writes it to disk unencrypted without your explicit consent. Keys are self-service: sign in to the console, create a key, and it works immediately, no contact with the team needed. Rename and revoke from the same page; a revoked key stops working within about 30 seconds. The Console guide covers the rest, including the per-swap view with explorer links. A key is wallet-agnostic: the same key serves an agent’s own wallet, a Virtuals ACP agent wallet, and any number of wallets at once, such as one per end user. The key grants access to the API, never to funds; the wallet that spends is always the one whose own key signed the operation.
Treat the key like a secret: server-side env vars, never in client-side code or repos. If a key leaks, revoke it in the console and mint a new one; swaps in flight are unaffected.

​
Rate limits

Limits are per account, per operation, over a one-minute window; all of your API keys share the same allowance: Exceeding a limit returns 429 with a Retry-After header (seconds until the window resets):
Back off for Retry-After seconds and retry; limits are per operation, so a throttled quote loop doesn’t block status polling. Minting more keys doesn’t raise the allowance. Need higher limits? Reach out and we’ll raise your account’s. To see how close you are to a limit, the console’s Rate Limits page shows your per-operation usage in the current window, alongside your tier and limits.