API Keys & Authentication

Generate your first API key and start authenticating requests to the Vital Protocol in under five minutes.

Quickstart

Step 1

Create an account & subscribe

Sign up on Mesh Native Exchange and choose a plan (Developer, Enterprise, or Bank). API keys are gated by your active subscription.

Step 2

Navigate to the Developer Portal

Go to the Developer Portal and open the Keys & Billing tab. Click Generate Key, choose a scope and environment (live or test), and give it a label.

Step 3

Copy & store your key securely

Your key is shown once in full. Copy it immediately and store it in a secrets manager (e.g. AWS Secrets Manager, Vault, or an environment variable). Never commit it to version control.

Step 4

Authenticate your first request

Pass the key in the Authorization header as a Bearer token on every API call. See the examples below.

Authenticating requests

Every request must include your API key in the Authorization header as a Bearer token.

shell

curl -X POST https://api.vital.exchange/v2/settlement \
  -H "Authorization: Bearer vital_live_xxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "counterparty": "acme-bank",
    "vital_amount": 50000,
    "rail": "SWIFT"
  }'

Key scopes

Scope your keys to the minimum permissions required — the principle of least privilege limits blast radius if a key is leaked.

full

Full access to all endpoints — recommended for server-side integrations.

settlement

Create and query settlement obligations only.

redemption

Redeem Vital into compute credits or fiat.

fiat

Execute fiat legs across ACH, SWIFT, SEPA, FedWire, RTP.

mesh_routing

Route workloads across mesh nodes and price in Vital.

privacy_tier

Query and set data privacy tiers (standard / confidential / sovereign).

Security best practices

Store keys in environment variables or a secrets manager — never in source code or client-side bundles.

Use test-environment keys (vital_test_…) during development and CI/CD; switch to live keys only in production.

Rotate keys regularly and immediately if a key is suspected of exposure — revoke it from the Developer Portal.

Restrict keys to the narrowest scope needed for each service or microservice.

Enable IP allowlisting for production keys where your infrastructure has stable egress IPs.

Authentication errors

The API returns standard HTTP status codes. Handle these in your integration layer:

error-responses.json

// 401 — missing or invalid key
{ "error": "Unauthorized", "code": "INVALID_API_KEY" }

// 403 — key scope does not allow this endpoint
{ "error": "Forbidden", "code": "INSUFFICIENT_SCOPE" }

// 429 — rate limit exceeded (retry after header included)
{ "error": "Too Many Requests", "code": "RATE_LIMIT_EXCEEDED", "retry_after": 5 }

On a 429, respect the Retry-After header before retrying. Burst limits apply per key per minute.

Ready to build?

Generate your first API key in the Developer Portal and start integrating the Vital Protocol today.