Authentication
Partners authenticate with the X-Api-Key header on the token gateway and ingest gateway. Mint and rotate keys in the dashboard; copy the exact base URL shown for your key.
Security model
| Layer | Role |
|---|---|
| Dashboard API key | Required on partner calls to token / ingest gateways |
| Scopes | Limit the key to token and/or ingest capabilities |
X-Admin-Api-Key | Elevated operator key for admin token ops only (not the public partner contract) |
Keys are compared with a constant-time equality check. Do not put keys in query strings.
Sending the key
GET /token-gateway/whoami HTTP/1.1
Host: token-gateway.blockskunk.com
X-Api-Key: <your-api-key>
curl -sS \
-H "X-Api-Key: $STRATUM_API_KEY" \
"https://token-gateway.blockskunk.com/token-gateway/whoami"
Use the exact host and path prefix from Dashboard → API Keys (ingest URL for webhook writes; token gateway for wallet ops).
Ingest permissions
Ingest keys (cd_ingest_…) are scoped to one network. Typical permissions:
| Permission | Allows |
|---|---|
ingest:ping | Health check only — no ledger write |
ingest:write | Seal assets / records to that network |
Prefer one key per adapter or environment. Full mint / revoke / rotation detail: Developer API → Authentication (signed in).
Admin routes
Admin wallet operations (distribute, top-up-reserve, reverse, audit-export, init) require X-Admin-Api-Key when configured. Those routes are not the primary public contract — see Tokens for wallet ops and API reference for the full surface.
Common errors
| Status | Code | Meaning |
|---|---|---|
401 | UNAUTHORIZED | Missing or invalid X-Api-Key |
403 | FORBIDDEN | Key present but lacks required scope |
503 | ADMIN_AUTH_UNAVAILABLE | Admin route called without admin auth configured |
Full envelope shape: Errors.
Signed-in operators: mint and rotate API keys (and see operator auth detail) under Dashboard → Account → Developer API docs.