Data API

Authentication

One key, sent one of two ways depending on the transport.

REST — a header

Every HTTP request carries the key in X-API-Key. There is no OAuth flow, no token exchange and no expiry — a key works until you revoke it.

curl

curl -H "X-API-Key: hex_live_..." \
  "https://api.hexio.trade/v1/wallets?limit=5"

JavaScript

const res = await fetch(
  'https://api.hexio.trade/v1/wallets?limit=5',
  { headers: { 'X-API-Key': process.env.HEXIO_API_KEY } },
);
const { wallets, meta } = await res.json();

Python

import os, requests

r = requests.get(
    "https://api.hexio.trade/v1/wallets",
    params={"limit": 5},
    headers={"X-API-Key": os.environ["HEXIO_API_KEY"]},
    timeout=30,
)
r.raise_for_status()
wallets = r.json()["wallets"]

WebSocket — a query parameter

Browsers cannot set headers on a WebSocket handshake, so the stream takes the key as ?api_key= instead. Everything else about it is the same key.

JavaScript

const ws = new WebSocket(
  `wss://wss.hexio.trade/v1/stream/transactions?api_key=${KEY}`,
);

A key in a URL is a key in a log. Query strings end up in proxy logs, browser history and referrer headers. Open browser streams through your own backend rather than shipping the key to the client — see Streaming.

Creating and revoking

Keys are managed on the Keys page. A key is shown once, at creation — we store only a SHA-256 hash of it, so a lost key cannot be recovered and has to be replaced. Revoking is immediate.

Each key carries the tier of the account that owns it
Upgrading a plan lifts the keys you already have — no need to reissue
Revoked keys stop working on the next request, not at the end of a period

Keeping a key safe

Environment variables, not source. A key in a repository is a key in every fork and every CI log.
Server-side only. Anything shipped to a browser is public, including keys in a bundled NEXT_PUBLIC_ variable.
One key per surface. Separate keys for production, staging and your laptop mean you can revoke one without taking down the others.
If a key leaks, say so. Revoking and reissuing costs nothing and takes seconds. Staying quiet is what costs.

Checking a key

GET /v1/usage is the cheapest way to confirm a key is live and see what it is entitled to. If it returns 401, the key is wrong or revoked; if it returns a tier you did not expect, the account is not on the plan you thought.

curl

curl -H "X-API-Key: $HEXIO_API_KEY" \
  https://api.hexio.trade/v1/usage