Authentication

Most API routes require a ChartInspect API key. The key identifies its owner, access tier, permissions, quotas, and any Enterprise restrictions.

#Public Routes

These discovery routes do not require a key:

[{"language":"text","code":"GET /api/v1/chains\nGET /api/public/catalog"},{"language":"bash","code":"curl -H \"x-api-key: YOUR_API_KEY\" \\\n  \"https://chartinspect.com/api/v1/onchain/mvrv?chain=bitcoin\""},{"language":"bash","code":"curl -H \"Authorization: Bearer YOUR_API_KEY\" \\\n  \"https://chartinspect.com/api/v1/onchain/mvrv?chain=bitcoin\""}]

JavaScript:

const response = await fetch(
  "https://chartinspect.com/api/v1/onchain/mvrv?chain=bitcoin&days=90",
  { headers: { "x-api-key": process.env.CHARTINSPECT_API_KEY } }
);

if (!response.ok) throw new Error(`ChartInspect returned ${response.status}`);
const payload = await response.json();

#Tier and Permission Checks

A valid key can still receive 403 Forbidden. Paid routes check both the subscription tier and the key's permission set. For example, an on-chain key needs the onchain permission, and a certified chart dataset needs its chart-data permission.

Enterprise keys can also carry custom endpoint and field grants, higher quotas, and IP allowlists. These restrictions are enforced in addition to normal tier checks. Contact support when an Enterprise policy needs to change.

#Security

1. Keep keys in server-side environment variables or a secret manager.
2. Never put a key in browser code, a public repository, a URL, or an embed iframe.
3. Use separate keys for development and production.
4. Rotate a key immediately if it is exposed.
5. Treat 401 as missing or invalid credentials and 403 as insufficient access.