Skip to main content

Authentication

All Zet API requests require authentication via an API key sent in the request header.

API Key

Include your API key in every request using the x-api-key header:

Key types

Key management

  • Contact zetdotmoney@gmail.com to generate or revoke keys
  • Each API key is scoped to your organization
  • You can have multiple active keys (e.g., one per environment)
  • Revoking a key takes effect immediately
Keep your API key secret. Never expose it in client-side code, public repositories, or frontend applications. All API calls must be made from your backend server.

API Secret

When you generate an API key, you also receive an API Secret (zet_secret_...). This is used exclusively for webhook signature verification.
See the Webhooks guide for verification implementation.
The API secret is shown only once when you create the key. If you lose it, revoke the key and create a new one.

Rate Limits

Rate limit information is included in every response:
When rate limited, you’ll receive a 429 response:

Best practices

  • Implement exponential backoff on 429 responses
  • Cache quote responses locally until they expire
  • Use webhooks instead of polling for transaction status
  • Batch wallet balance checks when possible

Request format

All requests use JSON:

Response format

Every response follows a consistent envelope: Success:
Success with pagination:
Error:

IP allowlisting

For additional security, you can restrict API key usage to specific IP addresses. Contact zetdotmoney@gmail.com to configure IP allowlisting for your production keys.

HTTPS only

All API requests must be made over HTTPS. Requests over HTTP will be rejected.