Authentication
The gateway uses Bearer authentication. Send your API key in the Authorization header on every request. A handful of endpoints — status and content-addressed retrieval — are public and need no key.
curl https://gateway.kepto.xyz/api/v1/account \
-H "Authorization: Bearer $KEPTO_API_KEY"Get a key
When signup is enabled, POST/api/v1/keys mints a free key and returns the secret once — only its SHA-256 digest is retained by the gateway. You can also create and manage keys from the API keys page in the app. Issuance is rate limited per client IP and UTC day.
curl -X POST https://gateway.kepto.xyz/api/v1/keysScopes
Every key carries a set of scopes; a request is rejected with HTTP 403 when the calling key lacks the scope an endpoint requires. Each endpoint's required scope is shown on its reference page.
| Scope | Grants |
|---|---|
| files:read | List stored files, read deal status, and retrieve verified bytes. |
| files:write | Upload files, create storage deals, and delete stored files. |
| account:manage | Inspect account usage and manage the account's credentials. |
| service:operate | Operational actions: challenge, settle, and fault storage deals. |
| rwa:read | Read registered real-world assets, documents, and fractionalization state. |
| equity:read | Read staked equity positions and recognized stock tokens. |
Rotate a key
POST/api/v1/keys/rotate atomically revokes the calling key and returns exactly one replacement secret. The credential belongs to an account, so rotation preserves stored files, allowance usage, and audit history. Individual keys can be revoked with DEL/api/v1/keys/{keyId}.
curl -X POST https://gateway.kepto.xyz/api/v1/keys/rotate \
-H "Authorization: Bearer $KEPTO_API_KEY"Keep your key safe
- The secret is shown exactly once at issuance. Store it in a secrets manager or environment variable — the gateway cannot recover it for you.
- Never embed keys in client-side code or commit them to version control. Proxy gateway calls through your own backend.
- Rotate immediately if a key may have leaked; the old credential stops working in the same atomic step that issues the replacement.