Skip to Content
Authentication

Authentication

All documented endpoints are protected by the B2B API key guard.

Required headers

  • X-API-Key: <your-api-key>
  • X-API-Secret: <your-api-secret>

You may send the secret as bearer token instead:

  • Authorization: Bearer <your-api-secret>

In that mode, keep X-API-Key and omit X-API-Secret.

Validation behavior

Guard implementation validates:

  • API key from x-api-key
  • Secret from x-api-secret or bearer token
  • Key/secret pair via integrations credential validation

Common auth errors

  • 401 Missing API key or secret
    • Ensure X-API-Key is present.
    • Ensure either X-API-Secret or bearer token is present.
  • 401 Invalid API key or secret
    • Credentials do not match.
    • Key may be revoked or rotated.
  • 403 on write routes
    • Valid API key/secret, but the integration has not completed portal 2FA setup (at least one portal user must have 2FA enabled). See below.

2FA-sensitive operations

Some B2B routes use an additional guard: at least one portal user on the integration must have two-factor authentication enabled. Otherwise the API returns 403 (not 401 — your key is valid, but the integration is not allowed to run that operation yet).

Enable 2FA in the Sonar portal for any user on the integration before calling these routes.

Strategies — create and update

  • All four create routes: createStrategyDcaBuy, createStrategyDcaSell, createStrategyVolumeBuy, createStrategyVolumeSell
  • All four set routes: setStrategyBuyDCA, setStrategySellDCA, setStrategyBuyVolume, setStrategySellVolume

Strategies — lifecycle

  • changeBalance, duplicateStrategy, removeStrategies
  • suspendStrategy, resumeStrategy, stopStrategy
  • disableAllStrategies, removeAllStrategies

Routes such as halt, archive, removeStrategy, and disableStrategy do not require 2FA. See Strategies — lifecycle.

Operations — deposits, withdraws, swaps

  • Deposits: deposits, depositTokens, bulkDepositTokens, retryDeposit, cancelDeposit, depositAndCreateStrategy
  • withdrawTokens
  • executeSwap

Read routes (getDeposits, getClaimHistory, getDepositAndCreateStrategyStatus, etc.) require API key/secret only.

OverviewChangelog