> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dexutils.io/llms.txt
> Use this file to discover all available pages before exploring further.

# DexUtils Pro API Authentication: API Keys and Bearer Tokens

> Authenticate every DexUtils Pro API request by passing your API key as a Bearer token in the Authorization header — no OAuth flows or sessions required.

Every request to the DexUtils Pro API must include your API key. The API uses standard Bearer token authentication — you pass your key in the `Authorization` header, and the server validates it before processing the request. There are no cookies, sessions, or OAuth flows to manage.

## How Authentication Works

Include the following header in every API request:

```
Authorization: Bearer YOUR_API_KEY
```

Replace `YOUR_API_KEY` with the key you generate from your DexUtils dashboard. The header is required on all endpoints — there are no public Pro API routes.

## Get Your API Key

<Steps>
  <Step title="Log in to DexUtils">
    Go to [dexutils.io](https://dexutils.io) and sign in to your account. Pro API key generation requires a **Premium plan** or an active **Pro API subscription**.
  </Step>

  <Step title="Open API Keys settings">
    Click your avatar in the top-right corner, then navigate to **Settings → API Keys**.
  </Step>

  <Step title="Generate a new key">
    Click **Generate New Key**, give the key a descriptive label (for example, `production-bot` or `analytics-dashboard`), and confirm.
  </Step>

  <Step title="Copy and store the key securely">
    Your key is displayed **once**. Copy it immediately and store it in a secrets manager or environment variable. You cannot retrieve the full key again after closing the dialog.
  </Step>
</Steps>

## Code Examples

The examples below authenticate against the `GET /networks` endpoint, which lists all supported chains. Swap in any other endpoint path and add the appropriate query parameters or request body as needed.

<CodeGroup>
  ```bash Authentication Example theme={null}
  curl https://api.dexutils.io/v1/networks \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -H "Content-Type: application/json"
  ```

  ```python authentication.py theme={null}
  import requests

  headers = {
      "Authorization": "Bearer YOUR_API_KEY",
      "Content-Type": "application/json"
  }

  response = requests.get("https://api.dexutils.io/v1/networks", headers=headers)
  print(response.json())
  ```

  ```javascript authentication.js theme={null}
  const response = await fetch('https://api.dexutils.io/v1/networks', {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY',
      'Content-Type': 'application/json'
    }
  });
  const data = await response.json();
  console.log(data);
  ```

  ```go authentication.go theme={null}
  package main

  import (
      "fmt"
      "io"
      "net/http"
  )

  func main() {
      req, _ := http.NewRequest("GET", "https://api.dexutils.io/v1/networks", nil)
      req.Header.Set("Authorization", "Bearer YOUR_API_KEY")
      req.Header.Set("Content-Type", "application/json")

      client := &http.Client{}
      resp, _ := client.Do(req)
      defer resp.Body.Close()
      body, _ := io.ReadAll(resp.Body)
      fmt.Println(string(body))
  }
  ```
</CodeGroup>

## Authentication Errors

If the API rejects your request due to an authentication problem, you'll receive one of the following HTTP error responses:

| Status Code             | Meaning                                     | Common Cause                                          |
| ----------------------- | ------------------------------------------- | ----------------------------------------------------- |
| `401 Unauthorized`      | Missing or malformed `Authorization` header | Header not sent, or `Bearer` prefix omitted           |
| `403 Forbidden`         | Header format is valid but key is rejected  | Key is invalid, revoked, or expired                   |
| `429 Too Many Requests` | Rate limit exceeded                         | Applies to free tier only; Pro API has no rate limits |

Each error response includes a JSON body with a `code` and `message` field. See the [Error Codes](/api/errors) reference for the full list of error shapes and recommended handling strategies.

## Security Best Practices

Treat your API key like a password. A leaked key gives anyone unrestricted Pro API access billed to your account.

<Warning>
  **Never commit your API key to version control.** Storing a key in source code — even in a private repository — is a common cause of credential leaks. Rotate any key that has been exposed immediately from **Settings → API Keys**.
</Warning>

Follow these practices to keep your key secure:

* **Use environment variables.** Store your key in an environment variable such as `DEXUTILS_API_KEY` and read it at runtime. Never hard-code the value in your source files.
* **Keep keys server-side.** Do not include your API key in client-side JavaScript, mobile app bundles, or any code that is shipped to end users.
* **Use one key per environment.** Generate separate keys for development, staging, and production so you can revoke a single key without disrupting other environments.
* **Rotate keys proactively.** Regularly regenerate keys for long-running projects, and immediately revoke any key you suspect has been compromised via **Settings → API Keys**.