Authentication
The API is keyless: no key, no account. X-API-KEY is reserved and ignored.
# Authentication
## Keyless
The Open API needs **no API key and no account**, and there is no billing. Every client is limited per IP address instead, by rate class: see [Rate limits](https://docs.rarebl.com/rate-limits).
~~~bash
curl "https://api.rarebl.com/open/fees/recommended?chain=btc"
~~~
## The reserved `X-API-KEY` header
`X-API-KEY` is reserved and **ignored** today, so you can already send it:
~~~bash
curl "https://api.rarebl.com/open/fees/recommended?chain=btc" \
-H "X-API-KEY: your-key-when-plans-launch"
~~~
Sending the header today changes nothing: you are still limited per IP. There are no keyed plans.
## Browsers and CORS
The API is public data with no cookies. It answers with `Access-Control-Allow-Origin: *`, allows the methods `GET`, `POST` and `OPTIONS`, and allows the headers `Content-Type` and `X-API-KEY`. `OPTIONS` requests answer `204`. This means a browser app, including the Try It panel in these docs, can call the API directly. The v2 calls that add the headers `Idempotency-Key`, `X-Hook-Token` or `X-Rarebl-Accept-Risk` need those headers to be allowed by the API's CORS rules as well; if a browser call with one of them fails with a network error while the same call works from your server, that is the reason.
## What other secrets exist
The API has no accounts, but a few calls use secrets of their own, and you keep them:
- **Webhooks:** `hooks/create` returns a `manageToken` (sent as the header `X-Hook-Token`) and a `signingSecret`, both shown once. See [Webhooks](https://docs.rarebl.com/guides/webhooks).
- **Hosted signing:** requires the header `X-Rarebl-Accept-Risk: hosted-signing` and a private key in a POST body. See [Hosted signing](https://docs.rarebl.com/guides/hosted-signing). The [SDKs](https://docs.rarebl.com/sdks/python) sign locally and never send a key.
Nothing in this API uses your Rarebl login.