Guide
Authentication
Every call carries your API key in a header. That is all the setup there is.
Send your key
Use either header. They do the same thing.
curl "https://api.tokconnect.com/v1/markets" \
-H "X-API-Key: $TOKCONNECT_API_KEY"curl "https://api.tokconnect.com/v1/markets" \
-H "Authorization: Bearer $TOKCONNECT_API_KEY"Get your key
Your key is on your account page. The REST API is part of the Pro and Enterprise plans. One key covers the REST API and the MCP server, and both draw on the same credits.
Keep it safe
- Call the API from your server, a script or a workflow tool. Never ship the key inside a web page or a mobile app.
- Read it from an environment variable or a secrets manager, not from source code.
- The Try it consoles in these docs keep your key in this browser tab only and send it to
api.tokconnect.comand nowhere else.
When it fails
| Status | Code | Meaning |
|---|---|---|
| 401 | unauthorized | The key is missing or not valid. Check the header name and copy the key again. |
| 403 | plan_required | The key is valid, but the REST API needs a Pro or Enterprise plan. |