Headers & Permissions

Required headers

All /api/v1/** endpoints require:

Header	Required	Description
x-api-key	Yes	Partner API key.
x-api-ts	Yes	Unix ms timestamp. ≤ 45 seconds drift from UTC.
x-api-nonce	Yes	Unique per key within the 45s window. UUID recommended.
x-api-sign	Yes	HMAC-SHA256 authentication value. Case-insensitive hex.
x-api-chain-id	Yes	Chain ID for this request.
x-api-p	Yes	Product type for this request.

Supported chain IDs

Value	Chain
8453	Base Mainnet
1	Ethereum Mainnet
143	Monad Mainnet
11155111	Ethereum Sepolia
10143	Monad Testnet
84532	Base Sepolia

Supported product types

Value	Description
Synfutures	Synfutures product.

Enum values are case-sensitive. These docs focus the Synfutures RWA API; use x-api-p: Synfutures.

API key validation

Check	Rule
API key	Must exist and be active.
Expiry	expires_at null or in the future.
IP whitelist	Required — an empty whitelist rejects every request (401); it does not mean "no restriction". Exact IP match only (no CIDR).
Scope	Must match chainId + productType + access.

Before your first request, add your egress IP to the key's whitelist. A key with an empty/unset whitelist rejects all requests with 401 Unauthorized — the single most common first-integration failure. Behind a gateway/proxy the server matches the IP it resolves (see below, usually the X-Forwarded-For value), not your machine's local IP.

Client IP resolution

1. First non-empty IP in X-Forwarded-For

2. X-Real-IP

3. TCP remoteAddr

Permission levels

access	Allowed operations
READ_ONLY	GET only.
WRITABLE	GET, POST, DELETE.