Skip to content

Getting started

Authentication

How keys work, what they are allowed to see, and the two separate limits that apply to them.

Every analysis route requires a key. Send it as a bearer token:

header
Authorization: Bearer mk_live_...

x-api-key: mk_live_... is accepted as well, for clients that cannot set an Authorization header.

What a key scopes

A key is not just a password — it is the boundary around your data. Every execution records the key that ran it, and history, permalinks, the cache, the watchlist, and change detection are all scoped to it.

That matters because a wallet analysis records the address somebody asked about. Publishing that on a shared list is not an acceptable default, so nothing is shared unless you explicitly publish it — see Public feed.

Two separate limits

Pace and spend are limited by different mechanisms, deliberately.

LimitWhat it protectsWhere it lives
Rate limitThe server, from a burstIn memory, per process, reset on restart
Daily quotaYour inference creditIn the database, durable across restarts

The quota is the one that guards money, which is why it is stored rather than held in memory. A self-serve key gets 50 analyses per UTC day.

check your remaining quota
curl https://api.molthood.org/api/v1/keys/me \
  -H "Authorization: Bearer mk_live_..."

Admin keys

The first key a deployment mints is an admin key. It carries a larger quota, can list and revoke other keys, and — importantly — reads every execution, not only its own.

Errors

StatusCodeMeaning
401authentication_requiredNo key was sent.
401invalid_api_keyThe key is unknown or revoked — the same message for both, so the endpoint cannot confirm which keys once existed.
403forbiddenThe route needs an admin key.
429rate_limitedToo many requests too quickly. Retry after the delay in the response.
429quota_exhaustedThe daily allowance is spent. resets_at says when it returns.