Authentication

All API requests require authentication using your API key.

API Key

Include your API key in every request using the X-API-Key header:

curl -H "X-API-Key: your_api_key" \
  https://api.eqgate.com/v1/tron/usdt/create

Alternatively, you can pass it as a query parameter (not recommended for production):

curl "https://api.eqgate.com/v1/tron/usdt/create?api_key=your_api_key"

API Secret

Your API secret is used to verify webhook signatures. Never expose it in client-side code.

Error Responses

401 Unauthorized

{
  "error": "API key required"
}

{
  "error": "Invalid API key"
}

Security Best Practices

1. Server-side only - Make API calls from your backend server
2. Environment variables - Store credentials in environment variables
3. Rotate keys - Regenerate keys if compromised
4. IP Whitelist - Consider restricting API access by IP (coming soon)