Authentication & limits
Authenticate from your server and make failures traceable.
Send X-API-Key on /v1/quote, /v1/order, /v1/order/{orderId}, and /v1/orders. GET /v1/chains is public. API keys are provisioned by the team; contact dev@kernelflow.org for access.
X-API-Key: <server-side-api-key>
X-Request-ID: <your-request-id>
Content-Type: application/json| Limit | Value |
|---|---|
| Per API key | 20 requests per second |
| Burst | 40 requests |
| Request body | 1 MiB |
| Order list page size | 1–100; default 20 |
An optional X-Request-ID is echoed in the response header. Record it with errors for support and request correlation. Do not log API keys or signed transaction payloads.
| HTTP status | Action |
|---|---|
| 401 | Check for a missing or incorrect API key. Do not retry. |
| 403 | Your source IP may not be allowed. Contact the operator. |
| 429 | Wait for Retry-After before a bounded retry. |