Skip to main content
WalletSuite issues two kinds of credential, one per integration surface. Pick the row that matches how you integrate.

​
Direct REST + SDK: your API key

If you call the REST API directly or use the SDK, you authenticate with an organization x-api-key. To get an API key, contact your WalletSuite point of contact. Each API key is issued per organization and controls access to specific endpoints and features. See Rate Limits for validity windows and per-key tier limits.

​
Authentication method

  • Type: apiKey
  • Location: HTTP request header
  • Header name: x-api-key
All authenticated requests must include this header. Requests without a valid API key are rejected before reaching business logic.

​
Agent keys

AI agents on the hosted MCP server never send an x-api-key. Each provisioned agent gets its own dedicated key — the agent’s identity, quota, billing, and revocation anchor: revoke it to cut that agent off without touching any other. Your server uses the key to authorize the agent and points the MCP client at the hosted endpoint. The raw key stays server-side — it never reaches the model, the browser, or a prompt. See Connect your agent.

​
HTTPS requirement

  • All API requests must be sent over HTTPS
  • Requests over plain HTTP will fail
  • Requests without authentication headers will fail
This requirement applies to every request, on every plan.

​
Request scope & permissions

  • All requests are scoped to your organization
  • Access is restricted based on your plan and enabled permissions
  • Unauthorized access attempts are rejected
MPC wallet signing is enabled per organization. Confirm your key has it with your WalletSuite contact.

​
Key activity

The dashboard shows two activity signals per API key:
  • Last seen — the last successful authentication with the key, updated at most once per minute. Authenticated requests count even if later rejected.
  • Requests — successful billable operations in the current calendar month (UTC).

​
Authentication errors

Authentication can fail for the following reasons:
  • Missing x-api-key header
  • Invalid or expired API key
  • Insufficient permissions for the requested endpoint
In those cases the API returns an appropriate 4xx HTTP status code (typically 401 or 403).

​
Premium endpoints

Certain endpoints are classified as Premium and are not enabled on every API key by default. To enable premium access, contact your account manager.
Premium access is enforced at the API level during request authentication.

​
Securing your credentials

WalletSuite credentials grant access to privileged resources. You are responsible for keeping them secure. The same handling applies to both API keys and agent keys. Best practices:
  • Store credentials in environment variables or a secrets manager
  • Restrict access to trusted server-side systems only
Never:
  • Commit credentials to source control (GitHub, GitLab, etc.)
  • Expose credentials in frontend or client-side applications
  • Share credentials publicly or with unauthorized parties