Authentication

Every request to the GriffNode API must include a secret API key. Keys are managed in your Dashboard.

LIVE

Production Key

sk_live_<48 hex chars>

Real transactions on mainnet. Keep this secret.

TEST

Sandbox Key

sk_test_<48 hex chars>

No real funds move. Safe to use during development.

Never expose your secret key. Do not include it in client-side code, browser JavaScript, version control, or any publicly accessible location. All API calls must be made server-side.

Making Authenticated Requests

Pass your key in the Authorization header using the Bearer scheme:

cURL

curl https://api.griffnode.com/v1/transactions/list \
  -H "Authorization: Bearer sk_live_a1b2c3d4e5f6..." \
  -H "Content-Type: application/json"

For language-specific examples (Node.js, Python, PHP, Go and more) see the GriffNode GitHub.

Security Checklist

Store keys in environment variables, never hardcode them

Add .env to your .gitignore before the first commit

Use sk_test_ during development, sk_live_ only in production

Rotate your live key immediately if it is ever exposed

Make every API call from your server, never from a browser or mobile client