> For the complete documentation index, see [llms.txt](https://docs.anchored.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.anchored.finance/trading-api/authentication/headers-and-permissions.md).

# Headers & Permissions

## Required headers

All `/api/v1/**` endpoints require:

| Header           | Required | Description                                             |
| ---------------- | -------- | ------------------------------------------------------- |
| `x-api-key`      | Yes      | Partner API key.                                        |
| `x-api-ts`       | Yes      | Unix ms timestamp. ≤ **45 seconds** drift from UTC.     |
| `x-api-nonce`    | Yes      | Unique per key within the 45s window. UUID recommended. |
| `x-api-sign`     | Yes      | HMAC-SHA256 authentication value. Case-insensitive hex. |
| `x-api-chain-id` | Yes      | Chain ID for this request.                              |
| `x-api-p`        | Yes      | Product type for this request.                          |

## Supported chain IDs

| Value      | Chain            |
| ---------- | ---------------- |
| `8453`     | Base Mainnet     |
| `1`        | Ethereum Mainnet |
| `143`      | Monad Mainnet    |
| `11155111` | Ethereum Sepolia |
| `10143`    | Monad Testnet    |
| `84532`    | Base Sepolia     |

## Supported product types

| Value      | Description       |
| ---------- | ----------------- |
| `Anchored` | Anchored product. |

> Enum values are case-sensitive. These docs focus the Anchored RWA API; use `x-api-p: Anchored`.

## API key validation

| Check        | Rule                                                                                                                               |
| ------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
| API key      | Must exist and be `active`.                                                                                                        |
| Expiry       | `expires_at` null or in the future.                                                                                                |
| IP whitelist | **Required — an empty whitelist rejects every request (`401`); it does not mean "no restriction".** Exact IP match only (no CIDR). |
| Scope        | Must match `chainId + productType + access`.                                                                                       |

> **Before your first request, add your egress IP to the key's whitelist.** A key with an empty/unset whitelist rejects *all* requests with `401 Unauthorized` — the single most common first-integration failure. Behind a gateway/proxy the server matches the IP it resolves (see below, usually the `X-Forwarded-For` value), not your machine's local IP.

### Client IP resolution

1. First non-empty IP in `X-Forwarded-For`
2. `X-Real-IP`
3. TCP `remoteAddr`

## Permission levels

| access      | Allowed operations       |
| ----------- | ------------------------ |
| `READ_ONLY` | `GET` only.              |
| `WRITABLE`  | `GET`, `POST`, `DELETE`. |