Authentication

Every request needs an API key. Generate one from your dashboard.

Sending the key

Pass your key in the X-API-Key header on every request:

curl -H 'X-API-Key: ohlcv_live_sk_<your_key>' \
  https://api.dexploit.dev/api/v1/pairs?token_address=...

const res = await fetch('https://api.dexploit.dev/api/v1/pairs?token_address=...', {
  headers: { 'X-API-Key': 'ohlcv_live_sk_<your_key>' }
});

For browser-side WebSocket connections where headers aren’t easy, you can pass the key as a ?api_key= query string instead. See Streaming: WebSocket.

Key format and security

Keys look like ohlcv_<env>_sk_<48_random_chars> where <env> is live, dev, or test. Keys are hashed (SHA-256) at rest. You see the full key once at generation. Lost a key? Rotate to issue a new one — there’s no way to retrieve the original. Rotation issues a fresh key and grants the old one a 7-day grace period before it stops working.

Tiers and RPS caps

Pricing is capped requests-per-second with unlimited monthly volume — pick a tier that matches your sustained throughput.

Tier	Price	Requests per second
Free	$0	20
Developer	$50/mo	100
Pro	$199/mo	500
Enterprise	Custom	unlimited

The cap is strict per second: requests are counted in fixed one-second windows, with no burst allowance above the cap. See Quotas & errors. Some endpoints are tier-gated (/tokens/{mint}/smart-money, /tokens/{mint}/whales). Free callers receive HTTP 200 with tier_locked: true rather than 429 — see Quotas & errors.

Inspecting your usage

Call GET /credits at any time to see your current tier, RPS cap, requests used in the current window, and feature flags:

curl -H 'X-API-Key: ohlcv_live_sk_<your_key>' https://api.dexploit.dev/credits

{
  "tier": "free",
  "rps_cap": 20,
  "rps_window_secs": 1,
  "current_window_used": 7,
  "current_window_remaining": 13,
  "monthly_used": 4321,
  "monthly_used_note": "informational; no monthly cap on Dexploit",
  "tier_features": {
    "smart_money_access": false,
    "whales_access": false
  }
}

Error responses

Errors are always enveloped, with error as an object:

{
  "success": false,
  "error": { "code": "UNAUTHORIZED", "message": "unauthorized" }
}

Branch on error.code; error.message is for humans. A few families are not on this shape yet: /swaps/* and /stats/* send error as a string code with a sibling message, and /tokens/{mint}/concentration sends error as a string. If error is a string, treat it as the message. See Quotas & errors for the per-family breakdown.

Status	Meaning
401	Key missing, malformed, or revoked.
429	RPS cap exceeded in the current window. Retry with backoff.

Full error catalog: see Quotas & errors.

Getting started

Concepts

Streaming

Examples

Sending the key

Key format and security

Tiers and RPS caps

Inspecting your usage

Error responses

​Sending the key

​Key format and security

​Tiers and RPS caps

​Inspecting your usage

​Error responses

Sending the key

Key format and security

Tiers and RPS caps

Inspecting your usage

Error responses