Skip to main content
Send an API key as a Bearer token on every data endpoint. Use this page when you set up a key or when a request returns 401, 402, 403, or 423.

​
Send the key

  • Discovery (GET /api/v1), the OpenAPI redirect, GET /api/v1/platforms, and GET /api/v1/health are public.
  • Every other /api/v1/* endpoint needs the Bearer token.
  • Remote MCP at /api/v1/mcp needs the same Bearer token. The ?token= query form is a legacy path. Avoid it, because URL secrets land in logs and shell history.

​
Know the key format

  • A key is oxi_sk_live_ followed by 64 hex characters, 76 characters in total.
  • The server stores an HMAC-SHA256 hash. It never stores the plaintext.
  • Each account holds one active key. A second create request returns 409 Conflict.
  • The dashboard shows the full key once. Later it shows only the prefix and the first four hex characters.

​
Create a key

  1. Log in at 0xinsider.com.
  2. Open Developers.
  3. Click Generate token.
  4. Copy the key before you leave the page.

​
Rotate a key

Rotation revokes the current key at once. Every consumer that still sends the old key gets 401 invalid_api_key until you update it.
  1. Open Developers.
  2. Click Rotate. The page shows the new key once.
  3. Update every consumer: .env files, deployed secrets, CI secrets, and MCP client configs.
Rotate at once if a key appears in a log, a commit, or a shared terminal.

​
Fix an auth error

  • Send Authorization: Bearer oxi_sk_live_.... A header without Bearer fails.
  • Count the characters. A full key has 76. A shorter value is a partial copy.
  • After a rotation the account has one valid key. Update every consumer that still holds the old one.
The key is valid, but the account has no active Pro subscription. Re-subscribe at Pricing. The same key resumes.
The account was deleted, or the request IP is blocked. Contact support@0xinsider.com.
The account is locked. Contact support@0xinsider.com.
A 402 body looks like this:

​
Manage keys from the dashboard

The dashboard uses these first-party routes. They use the session cookie, not an API key, and accept only 0xinsider origins. Errors lists every error.code. Rate Limits explains the budgets a key shares.