One bearer token. Reads are open; creating and reading orders needs a key.
Create a key self-serve — it's shown once, so store it securely. Each key is a full secret; treat it like a password and never ship it in front-end code.
| Prefix | Mode | Behavior |
|---|---|---|
cx_live_… | Live | Real swaps on the real engine. Returns real deposit addresses. 0% markup. |
cx_test_… | Sandbox | Simulated swaps. Deposit addresses are fake and the order auto-advances through its lifecycle. No real funds ever move. |
Build and test your integration end-to-end with a test key, then swap in a live key — the request/response shapes are identical.
Send it as a bearer token (preferred):
Authorization: Bearer cx_live_...
Or as a header, if that's easier for your client:
X-API-Key: cx_live_...
| Endpoint | Key |
|---|---|
GET /currencies | Optional (works without a key) |
GET /estimate | Optional (works without a key) |
POST /exchange | Required |
GET /order/{id} | Required — you can only read orders your key created |
404).Lost or leaking a key? Create a new one and stop using the old — revoked keys immediately return 401. There's no limit on how many keys you hold; use a separate key per app or environment so you can revoke one without touching the others.