Authentication & tiers

API keys

A key is the string wch_ followed by 43 URL-safe base64 characters (256 bits of entropy). Mint and revoke keys under Account → API keys.

• The plaintext is shown once, at creation. Only its SHA-256 hash is stored, so a lost key cannot be recovered — mint a new one.
• The dashboard lists each key by its first 12 characters, name, creation time, and last use.
• Revocation is immediate. Revoked keys stay listed for audit.
• How many keys you can hold at once is set by your plan (below); hitting the cap returns 403 api_key_limit_reached with your plan's limit.

Sending the key

Two equivalent headers; use whichever fits your HTTP client:

# Preferred
curl -H "Authorization: Bearer wch_YOUR_KEY" \
  "https://www.wolfofcapitolhill.com/api/v1/trades"

# Alternative
curl -H "X-Api-Key: wch_YOUR_KEY" \
  "https://www.wolfofcapitolhill.com/api/v1/trades"

When both headers are present, Authorization wins.

Anonymous access

Requests without a key are allowed for evaluation: 10 requests/minute and 1,000/month, tracked against a salted hash of your client address (the raw IP is never stored). Anonymous callers cannot use CSV export. Everything else behaves identically, so you can prototype before subscribing.

Plans and their limits

Subscriptions are managed under Account → Billing. The API is included in Pack and Den; Scout and Wolf are dashboard-focused plans.

Notes:

• Wolf includes CSV export in the dashboard but no API keys, so the API's format=csv is effectively a Pack/Den feature (a keyed caller's plan must include CSV export; anonymous callers never have it).
• Commercial use — redistributing the data or embedding it in a paid product — requires Den.
• Rate limits are enforced per key (each key gets its own minute window), so you can isolate workloads by minting one key per service.

Auth errors

A 403 plan_has_no_api_access response looks like:

{
  "error": "plan_has_no_api_access",
  "hint": "API access requires the Pack plan or higher. See /pricing to upgrade."
}