Skip to main content
Certain products use API keys to authenticate requests. Circle provides two types of keys for different use cases: API keys for server-side access and client keys for frontend applications.
Permissionless products like CCTP and Gateway do not require an API key.

API key

Authenticate server-side requests to Circle’s RESTful APIs.

Client key

Authenticate client applications with domain or app binding. Required for frontend SDKs.

​
API keys

An API key is a unique string used to authenticate and enable access to privileged operations on Circle’s APIs. It’s required for any RESTful API requests to Circle services. Without it, requests will fail.

​
Keep your API keys safe

API keys allow access to sensitive operations, so you must secure them.
  • Avoid public exposure: Never share API keys or include them in client-side code, public repositories, or other public mediums.
  • Manage securely: Use the Circle Console to generate and manage API keys. When generating a key, copy it exactly as displayed.
Losing control of your API key can result in financial loss.

​
API key authentication

Each key is tied to one environment. Use TEST_API_KEY for testnet requests and LIVE_API_KEY for mainnet requests.
Always use the full key string, including the prefix and all segments. Don’t split the key into parts. If you store keys in a .env file, set CIRCLE_API_KEY to the key for the environment you’re currently targeting.

​
Test authentication

To verify your API key setup, use the following curl command to retrieve wallets:
A successful response looks like this:
An error response looks like this:

​
API keys in Arc App Kits

Three App Kit capabilities use Circle API keys: For Swap and Earn, an API key gives you a higher rate limit instead of sharing one quota with all other unauthenticated traffic. Use a key in production or any time you expect to hit the shared limit. Mainnet access for Swap and Earn doesn’t require completing full onboarding or identity verification.
Moving from a Swap kit key to an API key? API keys are specific to one environment. Create one API key for testnet and another for mainnet, and switch the credential when you move from development to production.

​
Client keys

A client key is a unique string used to authenticate and authorize API access for apps using Circle’s SDKs. A client key is linked to either a specific host domain (websites), bundle ID (iOS), or package name (Android). This restricts access to pre-configured apps.
A client key must be included in the headers of all modular wallets SDK API calls.

​
Best practices for client keys

Client keys enable access to sensitive application operations, so protecting them is critical. Follow these best practices:
  1. Use separate keys for each application: Create separate keys for web and mobile apps (iOS, Android) to prevent shared vulnerabilities.
  2. Monitor for misuse: Set up alerts for unusual activity, such as unexpected spikes in API calls, and use monitoring tools to detect anomalies.
  3. Rotate keys regularly: Regenerate client keys periodically and update them in your apps to reduce risk if a key is compromised.
  4. Store keys securely: Use secure storage options like Local Storage or Secure Storage for mobile apps, and avoid unnecessary exposure.
  5. Restrict access: Limit the scope of client keys by associating them with specific apps or domains to minimize potential misuse.

​
Kit keys (legacy)

Kit keys are legacy. You can no longer create kit keys. Use an API key for new Swap integrations in Arc App Kits. Existing kit keys remain visible in the Circle Console and continue to work, so no action is required. There’s no end-of-life date.
A kit key is a unique string used to authenticate access for Circle’s developer kits. Kit keys provide a single credential that works across both testnet and mainnet environments, reducing configuration overhead when building.

​
Keep your kit keys safe

Kit keys enable access to SDK features, so protecting them is essential.
  • Avoid public exposure: Never share kit keys or include them in client-side code, public repositories, or other public mediums.
  • Manage securely: Use the Circle Console to view and manage your kit keys.
Losing control of your kit key can result in unauthorized access to SDK capabilities.