Authentication

Every request to the Triport API must carry a valid API key. There is no anonymous access. The platform accepts the key in four different forms so that existing clients, SDKs, and copy-pasted endpoint URLs all keep working — but they are tried in a fixed priority order, and the first one present wins.

Authenticate against one of two base URLs:

A key is scoped to one or more chains. When you call a chain-specific endpoint, the key must hold the matching scope (or the wildcard *); otherwise the request is rejected with 403 Forbidden. Missing or invalid credentials are rejected with 401 Unauthorized and a WWW-Authenticate: Bearer challenge.

The SDKs (@triport/sdk, triport-sdk) default to the x-token header. Use it for new integrations; the other forms exist for compatibility.

A successful, authenticated request returns the normal method result. When authentication fails, the body is a minimal JSON envelope and the response carries a WWW-Authenticate challenge header:

HTTP/1.1 401 Unauthorized
Content-Type: application/json
WWW-Authenticate: Bearer realm="proxy"

1. Sign in to the Triport portal at https://api.triport.io.

2. Create a project and generate an API key. Production keys are issued with the nl_live_ prefix (e.g. nl_live_1a2b3c4d…).

3. Assign the chains the key may call. Each chain grants the corresponding scope (see the mapping below).

4. Store the key as an environment variable — never commit it to source:

   cURL

   export TRIPORT_API_KEY="nl_live_1a2b3c4d5e6f7890abcdef"

The server checks for a token in the following order and uses the first one it finds:

Because the order is fixed, sending both an x-token header and an ?api-key= query parameter means the header is used and the query value is ignored.

Path-form details

The path-form POST /<chain>/<key> is accepted only for keys with the nl_live_ prefix. The chain URL segment must be one of:

A trailing slash is permitted (/eth/nl_live_…/). When you use the path-form, the chain segment also drives the scope check: the key must hold the scope shown above (or *), or the request returns 403 Forbidden.

A key carries one scope per chain it may call. The chain segment used in the path-form maps to the full scope stored on the key:

A key holding * satisfies every scope check.

See Errors for the full error envelope and the typed fields on each error code.

JavaScript (fetch)

const res = await fetch("https://api.triport.io/", {
  method: "POST",
  headers: {
    "x-token": process.env.TRIPORT_API_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    jsonrpc: "2.0",
    id: 1,
    method: "getSlot",
    params: [],
  }),
});


if (res.status === 401) {
  throw new Error("Authentication failed — check TRIPORT_API_KEY");
}
const { result } = await res.json();

TypeScript SDK (@triport/sdk)

import { Triport } from "@triport/sdk";


// The SDK sends the key via the x-token header by default.
const client = new Triport({
  apiKey: process.env.TRIPORT_API_KEY!,
  // baseUrl defaults to https://api.triport.io
  // baseUrl: "https://staging.api.triport.io", // for testing
});


const slot = await client.solana.getSlot();

Python (triport-sdk)

import os
from triport import Triport


# Authenticates with the x-token header.
client = Triport(api_key=os.environ["TRIPORT_API_KEY"])


slot = client.solana.get_slot()

• Pick one form. Forms are tried in priority order (x-token → Authorization: Bearer → ?api-key= → path-form); sending more than one means the lower-priority forms are ignored.
• Path-form is nl_live_* only. Keys without the nl_live_ prefix cannot authenticate through /<chain>/<key> — use a header form instead.
• Auth headers stop at Triport. The x-token and Authorization headers are stripped before any request is forwarded downstream; your key is never echoed to the response or onward.
• Keep keys out of URLs where you can. The ?api-key= query and path-form place the key in the URL, where it may be captured by proxy and access logs. Prefer the x-token header.
• Related: Rate limits · Errors · Getting started