Authentication

Every request to the Triport API must carry a valid API key. There is no anonymous access. The platform accepts the key in four different forms so that existing clients, SDKs, and copy-pasted endpoint URLs all keep working — but they are tried in a fixed priority order, and the first one present wins.

Authenticate against the base URL:

A key is scoped to one or more chains. When you call a chain-specific endpoint, the key must hold the matching scope (or the wildcard *); otherwise the request is rejected with 403 Forbidden. Missing or invalid credentials are rejected with 401 Unauthorized and a WWW-Authenticate: Bearer challenge.

The SDKs (@triport/sdk, triport-sdk) default to the x-token header. Use it for new integrations; the other forms exist for compatibility.

A successful, authenticated request returns the normal method result. When authentication fails, the body is a minimal JSON envelope and the response carries a WWW-Authenticate challenge header:

HTTP/1.1 401 Unauthorized
Content-Type: application/json
WWW-Authenticate: Bearer realm="proxy"

1. Sign in to the Triport portal at https://triport.io.

2. Create a project and generate an API key. Production keys are issued with the tri_live_ prefix (e.g. tri_live_1a2b3c4d…).

   Legacy keys. Keys issued before the 2026 rebrand carry the nl_live_ prefix. They remain valid indefinitely, and both spellings of the same key are accepted interchangeably: nl_live_<hex> and tri_live_<hex> refer to the same credential. No rotation is required.

3. Assign the chains the key may call. Each chain grants the corresponding scope (see the mapping below).

4. Store the key as an environment variable — never commit it to source:

   cURL

   export TRIPORT_API_KEY="tri_live_1a2b3c4d5e6f7890abcdef"

The server checks for a token in the following order and uses the first one it finds:

⚠️ Do not put API keys in URLs in production. The ?api-key= query and path-form place your secret in the request URL, which is routinely persisted in server/proxy access logs, browser history, Referer headers, and analytics — a well-known credential-leak vector (OWASP API Security: never carry tokens in the URL). Use the x-token (or Authorization: Bearer) header instead; reserve the URL forms for quick local testing only, and rotate any key that has appeared in a URL.

Because the order is fixed, sending both an x-token header and an ?api-key= query parameter means the header is used and the query value is ignored.

Path-form details

The path-form POST /<chain>/<key> is accepted only for keys with the tri_live_ prefix. The chain URL segment must be one of:

A trailing slash is permitted (/eth/tri_live_…/). When you use the path-form, the chain segment also drives the scope check: the key must hold the scope shown above (or *), or the request returns 403 Forbidden.

A key carries one scope per chain it may call. The chain segment used in the path-form maps to the full scope stored on the key:

A key holding * satisfies every scope check.

See Errors for the full error envelope and the typed fields on each error code.

JavaScript (fetch)

const res = await fetch("https://triport.io/", {
  method: "POST",
  headers: {
    "x-token": process.env.TRIPORT_API_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    jsonrpc: "2.0",
    id: 1,
    method: "getSlot",
    params: [],
  }),
});


if (res.status === 401) {
  throw new Error("Authentication failed — check TRIPORT_API_KEY");
}
const { result } = await res.json();

TypeScript SDK (@triport/sdk)

import { Triport } from "@triport/sdk";


// The SDK sends the key via the x-token header by default.
const client = new Triport({
  apiKey: process.env.TRIPORT_API_KEY!,
  // baseUrl defaults to https://triport.io
});


const slot = await client.solana.getSlot();

Python (triport-sdk)

import os
from triport import Triport


# Authenticates with the x-token header.
client = Triport(api_key=os.environ["TRIPORT_API_KEY"])


slot = client.solana.get_slot()

• Pick one form. Forms are tried in priority order (x-token → Authorization: Bearer → ?api-key= → path-form); sending more than one means the lower-priority forms are ignored.
• Path-form is tri_live_* only. Keys without the tri_live_ prefix cannot authenticate through /<chain>/<key> — use a header form instead.
• Auth headers stop at Triport. The x-token and Authorization headers are stripped before any request is forwarded downstream; your key is never echoed to the response or onward.
• Keep keys out of URLs. The ?api-key= query and path-form place the key in the URL, where it is routinely captured by proxy/access logs, browser history, and Referer headers (OWASP flags tokens-in-URL as a credential-leak vector). Prefer the x-token header; treat the URL forms as local-testing conveniences and rotate any key that has leaked into a URL.
• Related: Rate limits · Errors · Getting started