Authentication

Learn how to authenticate with the CoinStats API

Building an AI agent and want to skip the sign-up? See x402 Pay-Per-Request — no account, no API key, just a Base wallet with USDC.

The CoinStats API uses API key authentication for all requests.

Follow these steps to get started:

1. Sign up or log in to CoinStats

   Visit the CoinStats API dashboard and create an account or log in to your existing one.

2. Generate your API key

   After signing in, go to your dashboard and generate a new API key. This key will be used to authenticate your requests.

3. Use the API key in requests

   Add the API key to the X-API-KEY header in every request you make.

   curl -H "X-API-KEY: your-api-key" \
        https://openapiv1.coinstats.app/coins
   
4. Example: JavaScript (Fetch)

   const response = await fetch('https://openapiv1.coinstats.app/coins', {
     headers: {
       'X-API-KEY': 'your-api-key'
     }
   });
   const data = await response.json();
   
5. Secure your API key

   API Key Security Alert: Exposed API keys can lead to unauthorized usage, quota exhaustion, and unexpected charges. Always protect your keys in production applications.

   Why Key Protection Matters

   When you expose API keys on the client side, malicious actors can discover and abuse them, potentially:

   Exhaust Your Quota

   Malicious usage can quickly consume your API limits and cause service interruptions

   Increase Your Bills

   Unauthorized requests can push you over plan limits and trigger unexpected charges

   Essential Security Practices

   Environment Variables

   Never hardcode API keys in your source code. Use environment variables instead.

   // ❌ Don't do this
   const apiKey = "your-api-key-here";
   
   // ✅ Do this instead
   const apiKey = process.env.COINSTATS_API_KEY;
   

   # .env file
   COINSTATS_API_KEY=your-actual-api-key
   

   Frontend Security

   Never expose API keys in frontend code. Use these approaches instead:

   Backend Proxy (Recommended)

   Create a backend endpoint that forwards requests to CoinStats:

   // Backend endpoint
   app.get('/api/coins', async (req, res) => {
     const response = await fetch('https://openapiv1.coinstats.app/coins', {
       headers: {
         'X-API-KEY': process.env.COINSTATS_API_KEY
       }
     });
     const data = await response.json();
     res.json(data);
   });
   
   // Frontend code (no API key needed)
   const response = await fetch('/api/coins');
   const data = await response.json();
   

   Server-Side Rendering

   Fetch data server-side and pass it to your frontend:

   // Next.js example
   export async function getServerSideProps() {
     const response = await fetch('https://openapiv1.coinstats.app/coins', {
       headers: {
         'X-API-KEY': process.env.COINSTATS_API_KEY
       }
     });
     const data = await response.json();
     
     return { props: { coins: data } };
   }
   

   Key Management

   Separate Keys for Environments

   Use different API keys for development, staging, and production:

   const getApiKey = () => {
     switch (process.env.NODE_ENV) {
       case 'production':
         return process.env.COINSTATS_API_KEY_PROD;
       case 'staging':
         return process.env.COINSTATS_API_KEY_STAGING;
       default:
         return process.env.COINSTATS_API_KEY_DEV;
     }
   };
   

   Regular Key Rotation
6. Handle authentication errors

   If your API key is missing or incorrect, you’ll receive a 401 Unauthorized response:

   {
     "error": "Unauthorized",
     "message": "Invalid API key"
   }