Getting started
Authentication
How keys work, what they are allowed to see, and the two separate limits that apply to them.
Every analysis route requires a key. Send it as a bearer token:
Authorization: Bearer mk_live_...x-api-key: mk_live_... is accepted as well, for clients that cannot set an Authorization header.
What a key scopes
A key is not just a password — it is the boundary around your data. Every execution records the key that ran it, and history, permalinks, the cache, the watchlist, and change detection are all scoped to it.
That matters because a wallet analysis records the address somebody asked about. Publishing that on a shared list is not an acceptable default, so nothing is shared unless you explicitly publish it — see Public feed.
Two separate limits
Pace and spend are limited by different mechanisms, deliberately.
| Limit | What it protects | Where it lives |
|---|---|---|
| Rate limit | The server, from a burst | In memory, per process, reset on restart |
| Daily quota | Your inference credit | In the database, durable across restarts |
The quota is the one that guards money, which is why it is stored rather than held in memory. A self-serve key gets 50 analyses per UTC day.
curl https://api.molthood.org/api/v1/keys/me \
-H "Authorization: Bearer mk_live_..."Admin keys
The first key a deployment mints is an admin key. It carries a larger quota, can list and revoke other keys, and — importantly — reads every execution, not only its own.
Errors
| Status | Code | Meaning |
|---|---|---|
| 401 | authentication_required | No key was sent. |
| 401 | invalid_api_key | The key is unknown or revoked — the same message for both, so the endpoint cannot confirm which keys once existed. |
| 403 | forbidden | The route needs an admin key. |
| 429 | rate_limited | Too many requests too quickly. Retry after the delay in the response. |
| 429 | quota_exhausted | The daily allowance is spent. resets_at says when it returns. |