> For the complete documentation index, see [llms.txt](https://docs.swapkit.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.swapkit.dev/get-started/authentication-and-api-keys.md).

# Authentication and API keys

How to get a SwapKit API key, send it with your requests, keep it safe, and what the key controls.

Every request to `https://api.swapkit.dev` is authenticated with an API key sent in the `x-api-key` header.

```bash
curl "https://api.swapkit.dev/providers" \
  -H "x-api-key: YOUR_API_KEY"
```

### Getting a key

1. Sign in to the [SwapKit dashboard](https://dashboard.swapkit.dev/).
2. Click **Create app**. Each app has its own key.
3. Open the app and copy its **API Key**.

Use separate apps for separate environments or products, so each has its own limits, fee settings and usage stats.

### What a key controls

Your key is more than a credential. SwapKit uses it to apply:

* **Your affiliate fees.** Quotes requested with your key automatically include the affiliate addresses and fee tiers configured for it. See [Monetization](/get-started/monetization.md).
* **Your limits.** A new key allows **10 requests per minute on each service** and trades of up to **$1,000**. Both are raised on request. See [Rate limits and trade size](/get-started/quote-and-swap-implementation-flow.md#rate-limits-and-trade-size) for how they're counted and the response headers that report them.
* **Optional features** enabled per key, such as [SLIP-0024 payload signing](/guides/slip-0024-transaction-payload-signing.md).

### Keep your key server-side

Treat an API key like a password. Call the API from your backend and never ship the key in browser or mobile app code, where anyone can extract it and spend your limits.

To run swaps directly in the browser, use the [SwapKit Widget](/swapkit-widget/introduction.md) instead. It authenticates with [widget keys](/swapkit-widget/creating-your-widget-keys.md), which are bound to your domain and safe to expose.

### Authentication errors

| Status | Error                           | Meaning                                                                                                                                                     |
| ------ | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `401`  | `apiKeyInvalid`, `unauthorized` | The `x-api-key` header is missing, or the key is invalid, disabled or expired.                                                                              |
| `429`  | `rateLimitExceeded`             | Over your key's per-minute limit. See [Rate limits and trade size](/get-started/quote-and-swap-implementation-flow.md#rate-limits-and-trade-size).          |
| `403`  | `swapSizeExceeded`              | The trade is above your key's USD ceiling. See [Rate limits and trade size](/get-started/quote-and-swap-implementation-flow.md#rate-limits-and-trade-size). |