# Authentication

The Chain API uses API keys to authenticate requests. You can manage your API keys from the [Chain Dashboard](https://app.chain.com/).

## API Key Types

`sk_sandbox_...` Sandbox

Use sandbox keys for testing and development. No real money is moved.

`sk_live_...` Live

Live keys move real funds. Keep these secret and never expose in client-side code.

## Making Authenticated Requests

Include your API key in the `Authorization` header as a Bearer token.

```bash
curl https://api.chain.com/v1/wallets \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json"
```

## Required Headers

| Parameter | Type | Description |
| --- | --- | --- |
| `Authorization` required | `string` | Bearer token with your API key: Bearer sk_live_... |
| `Content-Type` required | `string` | Must be application/json for request bodies. |
| `X-Business-Id` | `string` | Required when operating in multi-business context. |
| `X-Idempotency-Key` | `string` | Unique key to safely retry requests without side effects. |

## API Key Scopes

API keys can be scoped to limit access to specific resources. When creating an API key, specify which scopes it should have.

| Scope | Description |
| --- | --- |
| `cards:read` | List and retrieve card details. |
| `cards:write` | Issue new cards. |
| `wallets:read` | List and retrieve wallet details. |
| `wallets:write` | Create new wallets. |
| `funding:read` | List funding transactions. |
| `funding:write` | Create funding requests. |
| `payouts:read` | List payout transactions. |
| `payouts:write` | Create new payouts. |
| `payees:read` | List registered payees. |
| `payees:write` | Register new payees. |
| `bank_accounts:read` | List linked bank accounts. |
| `bank_accounts:write` | Create Plaid link tokens to connect bank accounts. |
| `ledger:read` | Query ledger entries. |
| `webhooks:read` | List webhook endpoints. |
| `webhooks:write` | Create and delete webhook endpoints. |

## Multi-Business Context

If your account manages multiple businesses, include the `X-Business-Id` header to scope requests.

```bash
curl https://api.chain.com/v1/wallets \
  -H "Authorization: Bearer sk_live_..." \
  -H "X-Business-Id: biz_abc123"
```

## Rate Limits

Rate limits are applied per API key. If you exceed the limit, you'll receive a `429 Too Many Requests` response.

| Plan | Rate Limit | Burst |
| --- | --- | --- |
| Sandbox | 100 requests/min | 20 requests/sec |
| Production | 1,000 requests/min | 100 requests/sec |
| Enterprise | Custom | Custom |

Pax Dollar

USDP

Ripple USD

RLUSD

Dollar

USD

Tether

USDT

Pounds

GBP

Euro

Eur