Authentication
Every request uses an organization-owned API key in the X-API-Key header.
X-API-Key: gt_...Keys belong to your organization, not to a person. Owners and admins create them in the workspace under API keys; creating one needs a second-factor check. A key is shown once, when it is created.
Access levels
| Access | Can |
|---|---|
| Read only | Read wallets, gas health, policies and their revisions, and gas operations. |
| Read + register wallets | Everything above, plus POST /v1/wallets and POST /v1/gas/ensure. |
A key can expire in 30 days, 90 days, or a year, or never. Disable a key in the workspace as soon as you no longer need it.
What a key can't do
Keys can't change gas policies, manage API keys, or change your organization and its members. Those actions need a person who has passed a second-factor check in the workspace; an API key gets 403 STEP_UP_UNSUPPORTED_FOR_API_KEY.
Keep keys on your servers
Send the key from your backend, never from code that runs in a browser or a mobile app.
The API reference playground
The playground on these pages sends requests from your browser to https://api.gastanker.xyz and keeps the key you enter in this browser's local storage. Use a read-only key, and clear this site's data in your browser when you're done.