Start without a key

Two things answer with no account, no key, and no card:

The Pick of the Day ledger on api.0xinsider.com, which is production data.
The sandbox at https://0xinsider.com/sandbox, which answers every documented operation with its example payload.

Start with the first, use the second to shape your code, then swap 2 things for live data.

1 request, real data

curl "https://api.0xinsider.com/api/v1/pick-of-the-day/ledger" \
  | jq '.data.entries[] | select(.state == "opened")' | tail -30

One settled entry, as the route returned it:

{
  "state": "opened",
  "pick_date": "2026-09-20",
  "pick_rank": 4,
  "commitment_hash": "65948da47edfb88418a3b3d76f050fb9b8bbf625f3752f41cff9e542a568f36c",
  "commitment_nonce": "f1677e8dd365699c1cb6cfbfc0bb5a1ad6a51f60108643ce2f5af96f70e831e6",
  "commitment_algo": "sha256(canonical_json(payload)||nonce)",
  "sealed_at": "2026-09-20T19:25:12.404010Z",
  "kickoff": "2026-09-20T20:25:00Z",
  "payload": {
    "backed_price": "0.525000",
    "condition_id": "0xe8c438da07835b401331142e8db93e4f12b4a96c33bf53f1dda269e2b2a324e5",
    "kickoff": "2026-09-20T20:25:00Z",
    "pick_date": "2026-09-20",
    "pick_outcome_index": 0,
    "pick_outcome_label": "Over",
    "pick_rank": 4,
    "platform": "polymarket"
  },
  "outcome": "win",
  "matchup": "Commanders vs. Cowboys",
  "category": "Football",
  "permalink": "https://0xinsider.com/pick-of-the-day/2026-09-20/4"
}

The hash was published 1 hour before kickoff, and the nonce and the payload came after the game settled. SHA-256 over the payload bytes plus the decoded nonce reproduces commitment_hash, so you can check the pick did not move. A live pick is sealed: it carries the hash, sealed_at, and kickoff, and nothing that states a side or a price. The route takes no parameters and returns the whole ledger, one entry per (pick_date, pick_rank), with entry_count, sealed_count, opened_count, and uncommitted_count alongside entries. Any query parameter you add is ignored and named in the X-Query-Ignored response header. 0xinsider/picks mirrors it into a public git history and ships a verify.py. That is the whole onboarding for read-and-verify work. Nothing below is needed for it.

Every other operation: the sandbox

curl "https://0xinsider.com/sandbox/api/v1/leaderboard?limit=5"

The sandbox is the second servers entry of the OpenAPI document. Append any documented path to https://0xinsider.com/sandbox and you get that operation’s documented example: the same envelope, the same field names, the same types, the same cursor keys. Every response carries X-Oxi-Sandbox: true.

You send	The sandbox answers
Any documented JSON `GET`	`200` with that operation’s body, filled from a fixed seven-row world
`?limit=` and `?cursor=` on a list	That page of the seven rows; the last page reads `has_more: false` and `next_cursor: null`
A batch write	One item per identity you posted, in order, with the meta counts matching
Any other documented JSON write, webhooks included	The documented success body. Nothing is stored.
A parameter or body outside the document	The `400` or `415` the live API returns, with the same `error.code`, `error.reason` and `error.param`
`?sandbox_status=<code>`	That error, for any status the operation documents
A Markdown route, the SSE stream, or an export download	`400 bad_request`, naming the route. Call the live API for those.
An undocumented path	`404 not_found`
An undocumented method	`405` with `Allow`

Every value is one the live API could return: a grade is a grade letter, platform is polymarket, an address is 40 hex characters, and a trader’s id is trd_ plus that address. None of it is real. The wallets all start 0x51ab and no Polymarket wallet does, the markets are named “Sandbox Rovers” and “Sandbox Open”, and the seven rows never change. The sandbox proves your parsing, your error branches, your pagination and your request shapes. It proves nothing about grades, prices, or flow.

Page through a list

curl "https://0xinsider.com/sandbox/api/v1/leaderboard?limit=3"

Every cursor-paginated list serves the same seven rows.

{ "has_more": true, "next_cursor": "sbx_3", "total": 7 }

Follow next_cursor until it is null: sbx_3 gives rows 4 to 6, sbx_6 gives the last row with has_more: false and next_cursor: null. Write the loop here and it terminates. A cursor the sandbox did not issue, or one past the end, is 400 bad_request with error.reason cursor_expired, which is what the live API returns for a cursor that no longer resolves.

It refuses what the live API refuses

curl -i "https://0xinsider.com/sandbox/api/v1/leaderboard?limit=0"

{ "code": "bad_request", "message": "Query parameter 'limit' must be at least 1.", "param": "limit", "reason": "invalid_query" }

Documented query parameters and JSON request bodies are checked against the same OpenAPI document the sandbox answers from:

a value outside its schema is 400 with error.reason invalid_query;
a body that is missing, is not JSON, or does not fit the request schema is 400 invalid_body, with error.param naming the field;
a body without Content-Type: application/json is 415 unsupported_media_type;
an unknown query name is ignored and reported in X-Query-Ignored, and X-Query-Validation: strict makes it 400 unknown_query_parameter. Successful reads also carry X-Effective-Query.

So a client that sends a shape the live API rejects finds out here, before it has a key.

Simulate an error before you meet one

curl -i "https://0xinsider.com/sandbox/api/v1/leaderboard?sandbox_status=429"

HTTP/2 429
retry-after: 60

{"object":"error","error":{"code":"rate_limited","message":"Sandbox simulated a 429: the rate limit was exceeded.","retry_at":"2026-09-22T18:45:55.940Z"},"meta":{"request_id":"req_sandbox","cached":false,"cost":1}}

Any status the operation documents works: 400, 401, 402, 403, 404, 423, 429, 500, or 503. A 429 or 503 carries Retry-After: 60 and error.retry_at. Write the branch for each one here, where a mistake costs nothing. Errors lists the codes.

The sandbox key is optional

curl -X POST "https://api.0xinsider.com/api/v1/agents/register"

A 201 returns an oxi_sk_test_ key, the sandbox base URL, and every URL on the path to live access. Use it when your client or your agent framework insists on a credential. The sandbox answers the same with or without it, nothing is stored, and the key cannot be listed or revoked. The live API refuses it with 401 invalid_api_key and error.reason sandbox_api_key. That is deliberate: a sandbox key can never touch production data by accident. Register an agent has the fields.

Move to live data

Live data is a paid product. 3 steps, and only the first has a wait:

Subscribe to Pro

Pricing. Without it every data route answers 402 subscription_required.

Generate the key

Developers, then Generate token. The full key shows once.

Change 2 things in your code

The base URL becomes https://api.0xinsider.com, and every request carries Authorization: Bearer $OXINSIDER_API_KEY. Field names, envelopes, and cursors do not change.

Every official client makes step 3 one line:

Client	Sandbox	Live
Python	`oxinsider.Client.sandbox()`	`oxinsider.Client()`, which reads `OXINSIDER_API_KEY`
Go	`oxinsider.New(oxinsider.WithBaseURL("https://0xinsider.com/sandbox"))`	`oxinsider.New(oxinsider.WithBearerToken(key))`
TypeScript	`OxinsiderApiClient.sandbox()`	`new OxinsiderApiClient({ apiKey })`
`curl`	`https://0xinsider.com/sandbox/api/v1/...`	`https://api.0xinsider.com/api/v1/...` plus the header

What this does not give you

A free tier on production data. The 6 public routes, the Remote MCP handshake, and the sandbox are everything that works without a key. Everything else needs Pro.
Real numbers from the sandbox. A pnl of 1284500.42 belongs to a wallet that does not exist.
A stream, a Markdown context document, or an export file from the sandbox. Those answer 400 there.
A sandbox key that works on the live API, or a live key that changes a sandbox answer.

Go next

Quickstart

The same 5 reads, keyless first, then live.

Python client

pip install 0xinsider, sandbox in 3 lines.

Go client

go get github.com/0xinsider/0xinsider-go.

Authentication

The 6 public routes, the 2 credentials, and where a key belongs.

Getting started

Integrations

Guides

Concepts

1 request, real data

Every other operation: the sandbox

Page through a list

It refuses what the live API refuses

Simulate an error before you meet one

The sandbox key is optional

Move to live data

What this does not give you

Go next

Quickstart

Python client

Go client

Authentication

​1 request, real data

​Every other operation: the sandbox

​Page through a list

​It refuses what the live API refuses

​Simulate an error before you meet one

​The sandbox key is optional

​Move to live data

​What this does not give you

​Go next

Quickstart

Python client

Go client

Authentication

1 request, real data

Every other operation: the sandbox

Page through a list

It refuses what the live API refuses

Simulate an error before you meet one

The sandbox key is optional

Move to live data

What this does not give you

Go next