Authentication

Authenticating API Requests to Tower Developer APIs

Tower Console uses API keys to authenticate and authorize all developer API requests. Every request to the public endpoints must include a valid secret key.

---

Obtaining Your API Key

1. Create a developer account at Tower Developer Console.
2. Sign in and navigate to the API Keys section in your dashboard.
3. Click Generate New Key and select the appropriate environment and permission scopes (quotes, swaps, bridges, read).
4. Copy the generated secret key. API keys follow the format:
   • Live Keys: sk_live_<hex> (e.g. sk_live_********************)
   • Test Keys: sk_test_<hex> (e.g. sk_test_********************)

---

Passing the API Key

You can authenticate requests using either of the following HTTP headers:

Option 1: Bearer Token (Standard Authorization Header)

httpCopy
Authorization: Bearer sk_live_********************

Option 2: Custom API Key Header

httpCopy
x-api-key: sk_live_********************

All API communication requires HTTPS. The server automatically rejects unencrypted HTTP requests.

---

Code Examples

cURL

bashCopy
curl -X GET "https://tower-devapi.up.railway.app/api/public/prices" \
  -H "Authorization: Bearer sk_live_********************"

JavaScript (Fetch)

javascriptCopy
const response = await fetch("https://tower-devapi.up.railway.app/api/public/prices", {
  method: "GET",
  headers: {
    "Authorization": "Bearer sk_live_********************",
    "Content-Type": "application/json"
  }
});

const data = await response.json();
console.log(data);

Python (Requests)

pythonCopy
import requests

headers = {
    "Authorization": "Bearer sk_live_********************",
    "Content-Type": "application/json"
}

response = requests.get("https://tower-devapi.up.railway.app/api/public/prices", headers=headers)
print(response.json())

---

API Key Scopes

Some endpoints require specific permission scopes attached to your API key:

If an endpoint is accessed without the required scope, the API returns an HTTP 403 Forbidden response:

jsonCopy
{
  "success": false,
  "error": "Scope 'swaps' is required for this endpoint. Granted scopes: quotes, read."
}