Authentication
How Decryptr API keys work. Live and test keys, sending the key, scopes, rotation, revocation and keeping keys secret.
Every endpoint except GET /v1/status needs an API key. Keys belong to your Decryptr account and its plan, and you manage them on Your API keys.
Live and test keys
| Prefix | Reads | Uses calls |
|---|---|---|
dcr_live_ | Real data | Yes |
dcr_test_ | A fixed sample with the same shape | No |
Build and run your tests against a test key, then swap in a live key. Test keys follow the same per-second and per-minute limits, so your backoff code is exercised too.
A key looks like dcr_live_a1b2c3d4_ followed by 43 random characters. The recognisable prefix lets secret scanners such as GitHub's find a key that was committed by mistake.
Sending the key
Send it in the Authorization header:
curl https://data.decryptr.ai/v1/usage -H "Authorization: Bearer $DECRYPTR_API_KEY"If your client cannot set Authorization, send X-API-Key: <key> instead. Keys in a query string are refused with 400 key_in_query, because URLs end up in logs, browser history and referrer headers. Rotate any key you have sent that way.
The API only answers over HTTPS. It sends no CORS headers and only supports GET.
Scopes
Each key carries scopes, and a key can only call endpoints its scopes allow. Give a key only what it needs. A call outside its scopes gets 403 insufficient_scope; a call to an endpoint your plan does not include gets 403 plan_upgrade_required. Both name what is needed in the response.
| Scope | Endpoints | From plan |
|---|---|---|
(no key) | GET /v1/status | No key needed |
(any key) | GET /v1/usage | Developer |
analytics:read | GET /v1/trending/coins | Developer |
calls:read | GET /v1/calls/outcomes | Developer |
calls:read | GET /v1/calls/most-called | Starter |
sentiment:read | GET /v1/sentiment/callers, GET /v1/sentiment/{asset} | Developer |
analytics:read | GET /v1/analytics/crowd/{asset}, GET /v1/tags/{tag}/volume, GET /v1/trending/tags | Starter |
coins:read | GET /v1/coins/{asset}, GET /v1/market/coins, GET /v1/market/coins/{asset}, GET /v1/market/tickers, GET /v1/market/candles, GET /v1/market/trending | Developer |
prop:read | GET /v1/prop/programs | Developer |
levels:read | GET /v1/levels/rounds, GET /v1/levels/rounds/{id}, GET /v1/leaderboards/levels, GET /v1/levels/rounds/{id}/distribution | Pro |
liquidations:read | GET /v1/liquidations/{asset}, GET /v1/market/liquidations/heatmap, GET /v1/market/liquidations/totals | Starter |
orderflow:read | GET /v1/orderflow/delta | Starter |
orderflow:read | GET /v1/orderflow/footprint | Pro |
derivatives:read | GET /v1/derivatives/{asset}/funding, GET /v1/market/funding, GET /v1/market/open-interest, GET /v1/market/long-short, GET /v1/market/long-short/exchanges | Starter |
whales:read | GET /v1/whales/positions, GET /v1/whales/positioning | Pro |
calls:read | GET /v1/calls, GET /v1/calls/{id}, GET /v1/callers, GET /v1/callers/{handle}, GET /v1/events/{id}/calls | Pro |
traders:read | GET /v1/traders, GET /v1/traders/batch, GET /v1/traders/{id}, GET /v1/leaderboard, GET /v1/traders/{id}/prop, GET /v1/traders/wallets | Pro |
(any key) | GET /v1/tombstones | Starter |
signals:read | GET /v1/signals, GET /v1/signals/{id}, GET /v1/sentiment/{asset}/news | Starter |
signals:read | GET /v1/signals/{id}/impact | Pro |
stream:read | GET /v1/stream/signals | Pro |
analytics:read | GET /v1/trending/topics | Pro |
calendar:read | GET /v1/calendar | Starter |
social:read | GET /v1/profiles/{handle}, GET /v1/search/people, GET /v1/posts, GET /v1/posts/{id}, GET /v1/posts/{id}/replies, GET /v1/coins/{asset}/posts, GET /v1/trending/posts, GET /v1/search/posts, GET /v1/communities/{slug}/posts, GET /v1/lists/{id}, GET /v1/communities/{slug}/activity, GET /v1/rooms, GET /v1/rooms/{id}/activity | Pro |
stream:read | GET /v1/stream/posts | Business |
social:read | GET /v1/communities, GET /v1/communities/{slug}, GET /v1/communities/{slug}/members/history | Starter |
prop:read | GET /v1/prop/firms/{firm}/stats | Pro |
whales:read | GET /v1/whales/leaderboard | Business |
Rotation
Each account may have 2 active live keys and 2 active test keys, on every plan. That is enough to rotate without downtime:
- Create a new key with the same scopes.
- Deploy it everywhere the old key is used.
- Watch the old key's "last used" time on Your API keys until it stops moving.
- Revoke the old key.
You can also give a key an expiry date when you create it. An expired key gets 401 key_expired.
Revocation
Revoking a key stops it everywhere within 5 seconds. Requests with it then get 401 key_revoked. Revocation cannot be undone; create a new key instead.
If a payment fails, the API keeps working for a 7 day grace period with your per-second rate halved, then answers 402 payment_required until the subscription is paid. A cancelled subscription gets 402 subscription_cancelled. When a subscription is suspended, for example after a refund or dispute, requests get 402 as well.
Keeping keys secret
- Use keys only from your own servers. Never put a key in a mobile app, a browser page or a desktop app you ship: anyone can read it there. The API sends no CORS headers, so browser calls fail anyway.
- Keep keys in environment variables or a secret manager, not in source code.
- Use a separate key per service, so you can revoke one without touching the others.
- If a key leaks, revoke it at once and create a new one. Then tell us at [email protected] so we can check its recent use.
- Many failed key checks in a short time lock the client out for a while with
429 too_many_auth_failures.
We store only a hash of each key. We cannot show you a key again, and nobody at Decryptr can read it.