Authentication

v1 is closed to new integrations

Do not build on v1. The current API is v2 RFQ. v1 stays served for integrations already running on it, takes no new features, and gets no new endpoints.

Every request (except /v1/health and /v1/openapi.json) needs an API key. Send it as a bearer token:

curl https://api.textilecredit.com/v1/corridors \
  -H "Authorization: Bearer tx_live_a1b2c3d4.your_secret_here"

The X-API-Key: <key> header works too, if that's easier for your client.

Key format

A key looks like tx_live_a1b2c3d4.<secret>. The part before the dot (tx_live_a1b2c3d4) is the public prefix. It's safe to log and show in dashboards. The part after the dot is the secret. We only store a hash of the secret, so we show you the full key exactly once, when it's issued. If you lose it, ask us to revoke it and issue a new one.

Test vs live

Keys are environment-scoped, and the environment is baked into the prefix:

• tx_live_…: mainnet corridors (Ethereum, Polygon, BNB, Base, Celo).
• tx_test_…: testnet / local chains, kept fully separate from live data.

A test key can't touch a mainnet chain, and vice versa. If you send a chainId your key's environment doesn't allow, you get a 400 invalid_request.

TIP

BNB Smart Chain testnet (chain 97) runs a live cNGN ↔ USDT corridor for integration testing. Pass chainId: 97 with a tx_test_… key. See Testnet (BSC) for setup and faucets. Other testnets have no reactor deployed yet; a test key against those chains returns 400 explaining no FX settlement contract is available.

Scopes

Each key is granted a set of scopes. A request to an endpoint you're not scoped for returns 403 forbidden.

Scope	Grants
quotes:read	GET /v1/corridors, GET /v1/order-book, GET /v1/quote
trades:write	POST /v1/swaps, POST /v1/swaps/{id}/submit, POST /v1/limit-orders*
trades:read	GET /v1/swaps*, GET /v1/limit-orders
webhooks:manage	POST/GET/DELETE /v1/webhooks*

Ask for the narrowest set you need. A read-only integration only needs quotes:read + trades:read.

Keeping keys safe

• Never ship a live secret in client-side code. The API is server-to-server.
• Rotate by asking us for a new key, switching over, then revoking the old one.
• A revoked or suspended key returns 401 unauthorized, same as a bad key. We don't distinguish, on purpose.