Authentication & API keys

Anonymous reads#

Public endpoints and MCP reads can operate at the anonymous tier. A key is not required to read documentation, initialize MCP, list tools, or query anonymous entitlements. Upstream data availability and request limits still apply.

Issue a key#

Sign in to Ripper first. The key-management API uses your wallet session: GET /api/v1/keys lists keys, POST issues a key, and DELETE /api/v1/keys?id=KEY_ID revokes one. Issuance accepts a name. There is a maximum of ten active keys per wallet.

The issuance response contains the raw key once. Store it securely; subsequent reads return metadata rather than the secret.

// Run from your signed-in Ripper browser session.
const response = await fetch('/api/v1/keys', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ name: 'My integration' })
});
if (!response.ok) throw new Error('Key creation failed');
const issued = await response.json();
// Save issued.key securely. It is shown only once.

Use the key#

Send Authorization: Bearer YOUR_RIPPER_API_KEY from your backend or MCP client configuration. Do not embed the key in a public frontend bundle. Key-based tiers are supported by MCP and selected data routes; they do not replace wallet-session authentication for creation, building transactions, or key management.

Authorization: Bearer YOUR_RIPPER_API_KEY

Revoke or replace#

Revoke a key by its id using DELETE /api/v1/keys?id=KEY_ID from your signed-in session. If a key is lost or exposed, replace it. Never use a wallet private key as an API key.