Skip to main content

​
API keys

All v1 endpoints require an API key in the x-api-key header.

​
Creating API keys

  1. Sign in to the AFKCrypto dashboard
  2. Go to the API Keys section
  3. Click “Generate API Key”
  4. Give your key a descriptive name
  5. Optional: set an expiration (7 days, 30 days, 90 days, 180 days, or 1 year)
  6. Copy the key immediately — it will not be shown again

​
Key format

afk_<prefix>_<random>

Example: afk_xY3z_Ab12cD34Ef56Gh78Ij90Kl12Mn34Op56
  • Prefix: 4-character identifier for quick lookup
  • Random: 32-character cryptographically secure random string

​
Using API keys

Include the key with every request in the x-api-key header: 
curl -X GET https://api.afkcrypto.com/api/v1/wallets \
  -H "x-api-key: afk_xY3z_Ab12cD34Ef56Gh78Ij90Kl12Mn34Op56"

​
Security best practices

  • Never commit API keys to version control — use environment variables
  • Rotate keys regularly — set expiration for temporary access
  • Use separate keys per environment — dev, staging, production
  • Revoke unused keys immediately — reduce attack surface
  • Store securely — use a secrets manager (for example, AWS Secrets Manager or HashiCorp Vault)

​
Key expiration

API keys can optionally expire after a specified period:
  • Never expires (default): works until revoked
  • 7 days: short-term testing or demos
  • 30 days: contractor access or trials
  • 90 days: recommended for quarterly rotation
  • 180 days: semi-annual rotation
  • 1 year: annual rotation for stable integrations
What happens when a key expires?
  • Requests with that key return HTTP 401 UNAUTHORIZED
  • The key remains visible in the dashboard for audit history
  • Create a new key to replace it as needed
Monitoring expiration:
  • Dashboard labels keys as “Expired” or “Expiring soon” (≤ 7 days)
  • Configure alerts to avoid interruptions

​
Key limits

  • Maximum active keys: 10 per user
  • Rate limits apply; see Rate limiting
  • Revoke unused keys to stay under the limit

​
Revoking API keys

Revoke a key immediately in the dashboard:
  1. Open API Keys
  2. Find the key to revoke
  3. Click “Revoke Key”
  4. Confirm the action
Note: Revocation is permanent and takes effect immediately.

API reference

Policies & Security

Supported chains