Authentication

curl -s https://api.cantoncap.cc/v1/global/metrics/latest \
  -H "X-API-Key: $CANTONCAP_API_KEY"

Keep the key on your server

The key is a long-lived shared secret. Calling the API directly from a browser publishes it to every visitor, so route requests through your own backend and keep the key there. The streaming API makes this unavoidable in any case: it authenticates from a request header, which the browser WebSocket API cannot set.

What a plan bounds

• requests_per_minute — sustained request rate.
• maximum_history_days — how far back a history request may reach.
• maximum_page_size — the ceiling on limit.
• maximum_concurrent_streams — simultaneous stream subscriptions.

Scope, not just access

A key also determines what is visible. Records observed under a caller-scoped venue credential are returned only to that caller; party-scoped records require an explicit party entitlement. Anything outside your scope is withheld as not found rather than returned partially — a record you cannot see does not appear as an empty object.