API Keys and Authentication

The Hashless API uses a simple "bearer token" authentication method that can be used from most programming languages and platforms with no additional code or dependencies.

First, register for an API key from your Hashless Account Settings page.

API keys are returned as a single, long text string that looks like this:

v3//01GQNCQ3Y15XF2ERC51JYH16NC||wim3njcmtyoupbcd8dendbw1a4mcmn6rpsymh7m78hd4zdcstgiy

Make sure to store the new key in a secure location. Keys cannot be retrieved from the Hashless interface after registration, although you can always generate a new key and delete the old one.

When making a request to any API endpoint, add an Authorization header to the request with a value of Bearer: $YOUR_API_KEY, for example:

Authorization: Bearer v3//01GQNCQ3Y15XF2ERC51JYH16NC||wim3njcmtyoupbcd8dendbw1a4mcmn6rpsymh7m78hd4zdcstgiy

Adding this header is usually pretty easy. Examples for Python, JavaScript and shell (curl) are below.

import requests

HASHLESS_API_KEY="v3//01GQNCQ3Y15XF2ERC51JYH16NC||wim3njcmtyoupbcd8dendbw1a4mcmn6rpsymh7m78hd4zdcstgiy"
auth_val = "Bearer %s" % HASHLESS_API_KEY
requests.get(HASHLESS_API_ENDPOINT, headers={"Authorization": auth_val})

const options = {
  method: 'GET',
  headers: {
    Authorization: 'Bearer v3//01GQNCQ3Y15XF2ERC51JYH16NC||wim3njcmtyoupbcd8dendbw1a4mcmn6rpsymh7m78hd4zdcstgiy'
  }
};

await fetch(ENDPOINT, options)

export HASHLESS_API_ENDPOINT=...
export HASHLESS_API_KEY='v3//01GQNCQ3Y15XF2ERC51JYH16NC||wim3njcmtyoupbcd8dendbw1a4mcmn6rpsymh7m78hd4zdcstgiy'
curl $HASHLESS_API_ENDPOINT -H 'Authorization: Bearer ${HASHLESS_API_KEY}'

🚧

API keys must be kept secret. Customers are responsible for API activity due to key loss and should take care to store them with appropriate precautions.

As a best practice, we recommend against checking API keys into your codebase; instead, store them separately as configuration (for example, as environment variables). In production, you may wish to store API keys using secrets management systems like AWS Secrets Manager or Hashicorp Vault.

Important: Currently, no user-generated content or personally identifiable information is available via the Hashless API. However, future features may include data from your organization, such as personalized address names or transaction notes.

Hashless reserves the right to suspend any API key that has been disclosed in public or that exhibits a pattern of activity that indicates the key has been compromised (i.e. via credential harvesting).