Authentication
Every request carries a ledger-scoped API key as a Bearer token.
Header
Authorization: Bearer sk_xxxxxxxx_your_secretKeys are issued per ledger in the dashboard and have the form sk_{prefix}_{secret}. The ledger is derived from the key; no ledger id appears in any URL.
Failures
| Status | code |
When |
|---|---|---|
401 |
UNAUTHORIZED |
Header missing, key unknown, or key inactive |
403 |
FORBIDDEN |
Key lacks a capability the endpoint requires |
429 |
RATE_LIMIT_EXCEEDED |
Budget exhausted — see Rate limits |
{ "success": false, "message": "Invalid or inactive API key.", "code": "UNAUTHORIZED" }Capabilities
Two endpoint groups need a capability granted on the key:
| Capability | Endpoints |
|---|---|
strings:participate:{code} |
POST /strings/{code}/transfer, POST /strings/{code}/convert |
attributes:admin |
POST /attribute-definitions, PATCH /attribute-definitions/{key}, PUT /attribute-settings |
A missing capability returns 403; the attribute endpoints use the code ATTRIBUTE_ADMIN_CAPABILITY_REQUIRED.
A key grants full read and write access to its ledger. Keep it server-side; never embed it in a browser or mobile app.