Authentication

v1 is closed to new integrations

Do not build on v1. The current API is v2 RFQ. v1 stays served for integrations already running on it, takes no new features, and gets no new endpoints.

Every request (except /v1/health and /v1/openapi.json) needs an API key. Send it as a bearer token:

curl https://api.textilecredit.com/v1/corridors \
  -H "Authorization: Bearer tx_live_a1b2c3d4.your_secret_here"

The X-API-Key: <key> header works too, if that's easier for your client.

Key format

A key looks like tx_live_a1b2c3d4.<secret>. The part before the dot (tx_live_a1b2c3d4) is the public prefix. It's safe to log and show in dashboards. The part after the dot is the secret. We only store a hash of the secret, so we show you the full key exactly once, when it's issued. If you lose it, ask us to revoke it and issue a new one.

Test vs live

Keys are environment-scoped, and the environment is baked into the prefix:

• tx_live_…: mainnet corridors (Ethereum, Polygon, BNB, Base, Celo).
• tx_test_…: BNB Smart Chain testnet only (chainId: 97), kept fully separate from live data.

A test key can't touch a mainnet chain, and vice versa. If you send a chainId your key's environment doesn't allow, you get a 400 invalid_request.

A test key only works on chain 97

BSC testnet is the one testnet with settlement contracts deployed. It runs a cNGN ↔ USDT corridor for integration testing: pass chainId: 97 with your tx_test_… key. See Testnet (BSC) for setup and faucets.

Every other testnet — Sepolia, Base Sepolia, Celo Sepolia — has no reactor, so a test key naming one returns a 400 saying that chain has no FX settlement contract.

Scopes

Each key is granted a set of scopes. A request to an endpoint you're not scoped for returns 403 forbidden.

Scope	Grants
quotes:read	GET /v1/corridors, GET /v1/order-book, GET /v1/quote
trades:write	POST /v1/swaps, POST /v1/swaps/{id}/submit, POST /v1/limit-orders*
trades:read	GET /v1/swaps*, GET /v1/limit-orders
webhooks:manage	POST/GET/DELETE /v1/webhooks*

Ask for the narrowest set you need. A read-only integration only needs quotes:read + trades:read.

Keeping keys safe

• Never ship a live secret in client-side code. The API is server-to-server.
• Rotate by asking us for a new key, switching over, then revoking the old one.
• A revoked or suspended key returns 401 unauthorized, same as a bad key. We don't distinguish, on purpose.