Error Codes

Requests made through API key authentication can fail with the following error codes:

• api_key_not_found — The API key provided could not be found.
• failed_to_parse_timestamp — The timestamp provided could not be parsed.
• timestamp_too_far — The timestamp is too far from the server timestamp (more than 30 seconds in the past or future)
• failed_to_decode_hex_signature — The hex signature could not be decoded.
• signature_mismatch — There is a mismatch in the signature.
• key_doesnt_have_scope — The API key does not have the required scope for the endpoint.
• ip_not_permitted — The IP address making the request is not whitelisted for this API key.

API Key Authentication

Some of the endpoints require authentication through API keys.

Generating an API Key

To generate an API Key

1. Sign into your account with a web browser
2. Click on your address in the upper right corner
3. Click "API Keys”
4. Click Add New API Key
5. Name the key
6. Select the correct permissions
7. Click "Create API Key”
8. Record the secret key

Important: The secret key should be treated the same way as a password and not stored in an unencrypted manner. Please place this information in a password manager or key vault.

IP Whitelisting

It is strongly recommended to whitelist the IP addresses which are allowed to make requests for the given API key.

Up to 16 IP addresses can be added per API key. Only IPv4 addresses are supported at this time.

The default state with no whitelisted addresses (empty whitelist) is to allow requests from any IP. If there are addresses on the whitelist, then only requests from the whitelisted IPs are allowed. Requests from IPs not on the whitelist will error with code 401 and message: "IP addr x.x.x.x is not allowed for key ondoKeyId_yyyyyyyy".