Authentication

TL;DR

Both the Fuse API (zap.dzap.io) and the Trade API (api.dzap.io) accept an optional API key.
The key is sent as the x-api-key header - not Authorization: Bearer.
Without a key, requests fall back to per-IP handling.

Agents can also discover auth requirements through /auth.md, /.well-known/oauth-protected-resource, and /.well-known/oauth-authorization-server.

Getting an API key

API keys are issued by DZap to partners. Reach out via Discord or support@dzap.io with:

Your project name
Expected request volume
Endpoints you’ll use most

You’ll receive a key tied to your project. Treat it like a password.

Using an API key

curl -X POST https://api.dzap.io/v1/quotes \
  -H "Content-Type: application/json" \
  -H "x-api-key: dzap_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -d '{ ... }'

curl -X POST https://zap.dzap.io/v1/quote \
  -H "Content-Type: application/json" \
  -H "x-api-key: dzap_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -d '{ ... }'

import { DZapClient } from '@dzapio/sdk';

// The key applies to both api.dzap.io and zap.dzap.io requests made through this client instance
const dzap = DZapClient.getInstance('dzap_xxxxxxxxxxxxxxxxxxxxxxxx');

Never put API keys in client-side code. Proxy through your backend. Server-only.

Without a key

Every endpoint on both APIs works without a key - quotes, builds, status, tokens, positions, and so on. Unauthenticated requests are handled per-IP instead of per-key.

Last modified on July 14, 2026

Introduction Error codes

​TL;DR

​Getting an API key

​Using an API key

​Without a key

TL;DR

Getting an API key

Using an API key

Without a key