Skip to main content
Partner endpoints require an API key, sent as a bearer token.
An X-API-Key: <key> header is also accepted.
Keep your key server-side. Never ship it to a browser or mobile client — anyone with the key gets your rate tier and revenue attribution.

​
Getting a key

Keys are issued out-of-band as part of onboarding. Contact us to start: abhishek@spiralstake.xyz. Each key is tied to a partner profile with:
  • a rate tier (requests/minute),
  • usage attribution for revenue reconciliation.
Only the key’s hash is stored — the raw key is shown once at issuance.

​
Behavior

Public read endpoints work with no key. Sending your key on them is optional — it just moves them onto your rate tier instead of the shared per-IP limit.