Key lifecycle
1
Create a key in the dashboard
Create and manage keys in the 0xArchive dashboard. New accounts start on the Free tier.
2
Store it outside source control
Load the key from an environment variable or secret manager. Never place it in checked-in code, notebooks, prompts, logs, screenshots, or public issue text.
3
Pass it the way each client expects
The REST API takes the key in an HTTP header. WebSocket takes it during connection setup. The SDKs, CLI, Agent skill, and API-key agent workflows read it from their runtime environment. The hosted MCP server uses the client’s built-in OAuth flow instead and needs no 0xArchive API key.
4
Rotate when access changes
Replace a key when a workflow, machine, environment, or teammate no longer needs access.
Where each client reads the key
Separate keys by environment
Use a different key for local development, CI, staging, production, and agent or tooling work where you can. Separate keys make rotation and incident diagnosis safer, and a leaked development key cannot expose a production workflow.Keep keys out of the browser
Do not embed a 0xArchive API key in frontend JavaScript or ship it to a browser. A browser application should call a backend you control. That backend holds the key, enforces user-level access, and keeps the credential out of browser URLs, telemetry, and copied prompts.Wallet verification
SIWE verifies wallet ownership for account and credential flows. It is not the default authentication method for market-data calls. Existing-wallet verification starts with/v1/auth/web3/challenge, then submits the signed message to POST /v1/auth/web3/verify. Follow SIWE verification for the complete wallet flow.
0xArchive never requests private keys or seed phrases, cannot move funds, cannot approve transactions, and cannot place or cancel venue orders.