Skip to main content
Blockworks authenticates requests with an API key sent in a request header. There is no OAuth flow, no token exchange, and no session state. Every request carries the key. One key covers every product. The same key authenticates the Data API, Monitoring, the Token Unlocks API, and the MCP Server. Datashare access is granted to your warehouse account rather than by key. See Datashares.

​
Get an API key

Create and manage keys at app.blockworks.com/account/api. Keys are shown once at creation, so store yours in a secret manager or environment variable.

​
Using your key

Pass the key in the X-Blockworks-API-Key header on every request to https://api.blockworks.com:
For a full first request in curl, Python, and JavaScript, see the Data API quickstart or the Monitoring quickstart.
The header name is X-Blockworks-API-Key. Header names are case-insensitive, so x-blockworks-api-key works identically. The legacy x-messari-api-key header is still accepted for existing integrations; new code should send X-Blockworks-API-Key.

​
Access tiers

Not every dataset requires the same level of access. Each model in the catalog declares an access tier, and the API enforces it per request: Models restricted to internal users do not appear in the public catalog or in this reference. Paid is the default tier of the reference, so reference pages only call out the exceptions (public models and models that need a specific permission). You can read the tier of any model from access.tier in the catalog endpoints. See Errors for the exact messages.

​
Rate limits

The Data API itself enforces no rate limit and sends no RateLimit-* or Retry-After headers. Responses are cached for 30 minutes (Cache-Control: max-age=1800), so repeating an identical request within that window is served from cache. Keep concurrency reasonable and prefer selections and narrow time windows over large repeated pulls.
Keep your key secret. Never commit it to version control, embed it in a client-side bundle, or paste it into a shared document or support ticket. Requests made with your key count against your account.

​
Handling keys safely

Server-side only

Call the API from your backend. A key shipped to a browser or mobile app is a public key.

Environment variables

Load the key from the environment or a secrets manager rather than hardcoding it.

Rotate regularly

Regenerate your key periodically, and immediately if you suspect it has leaked.

​
Verify your setup

/query/ping is a lightweight endpoint for confirming your client is wired up correctly. The request above returns: