Authentication & rate limits

Swap endpoints are open — no API key required for quotes and builds.

Rate limits (per IP)

• Quote / build / cross-chain: 300 requests/minute
• Chains, tokens, settings: 120 requests/minute

Optional wallet JWT

POST /auth/challenge → sign message → POST /auth/verify for profile and admin access. Not required for swap execution.

Agent identification

Send X-Client-Id and X-Client-Source: agent on every request for admin analytics.