# Authentication

## Keyless

The Open API needs **no API key and no account**, and there is no billing. Every client is limited per IP address instead, by rate class: see [Rate limits](https://docs.rarebl.com/rate-limits).

~~~bash
curl "https://api.rarebl.com/open/fees/recommended?chain=btc"
~~~

## The reserved `X-API-KEY` header

`X-API-KEY` is reserved and **ignored** today, so you can already send it:

~~~bash
curl "https://api.rarebl.com/open/fees/recommended?chain=btc" \
  -H "X-API-KEY: your-key-when-plans-launch"
~~~

Sending the header today changes nothing: you are still limited per IP. There are no keyed plans.

## Browsers and CORS

The API is public data with no cookies. It answers with `Access-Control-Allow-Origin: *`, allows the methods `GET`, `POST` and `OPTIONS`, and allows the headers `Content-Type` and `X-API-KEY`. `OPTIONS` requests answer `204`. This means a browser app, including the Try It panel in these docs, can call the API directly. The v2 calls that add the headers `Idempotency-Key`, `X-Hook-Token` or `X-Rarebl-Accept-Risk` need those headers to be allowed by the API's CORS rules as well; if a browser call with one of them fails with a network error while the same call works from your server, that is the reason.

## What other secrets exist

The API has no accounts, but a few calls use secrets of their own, and you keep them:

- **Webhooks:** `hooks/create` returns a `manageToken` (sent as the header `X-Hook-Token`) and a `signingSecret`, both shown once. See [Webhooks](https://docs.rarebl.com/guides/webhooks).
- **Hosted signing:** requires the header `X-Rarebl-Accept-Risk: hosted-signing` and a private key in a POST body. See [Hosted signing](https://docs.rarebl.com/guides/hosted-signing). The [SDKs](https://docs.rarebl.com/sdks/python) sign locally and never send a key.

Nothing in this API uses your Rarebl login.