Skip to main content

​
Current Rate Limits

​
Unauthenticated

​
Authenticated (with API key specified)

Higher limits may be available for clients in the custom terms. Please Contact Us for more information.
Quote-related endpoints and other public endpoints use separate rate-limit scopes. A valid x-api-key selects the authenticated tier and may use a custom requests-per-minute limit configured for your integration. If you exceed your rate limits, you’ll receive a 429 Too Many Requests HTTP response.

​
Rate Limit Headers

API responses include rate limit headers:

​
How to Get an API Key

To obtain an API key with higher rate limits, you need to register on the portal.delora.build. After registration, your unique API key will be generated.

​
Best Practices

To avoid hitting rate limits:
  • Cache results from GET /v1/tokens, GET /v1/chains, GET /v1/tools, and other static metadata endpoints
  • Avoid polling frequently for the same data
  • Batch or debounce user input that triggers API calls

​
Using the API key

Most Delora routing endpoints work without an API key, although an API key enables the authenticated tier. The Transaction Tracking API (/v1/transactions*) always requires a valid API key.
Authentication to Delora API is performed via the custom HTTP header x-api-key with an API key. Example:
Never expose your x-api-key in client-side environments such as browser-based JavaScript. Using the API key on the client side can lead to unauthorized usage or abuse of your key, as it becomes publicly accessible in the browser’s developer tools or network tab. For server-side integrations (e.g. API requests from your backend), always keep your key secret and secure.
For browser-based widget integrations, keep the API key on your backend and proxy Delora requests server-side. The current @deloraprotocol/widget implementation supports this by letting you point config.apiUrl at your proxy instead of passing apiKey from the browser. See Configure Widget.

​
Transaction Tracking API

GET /v1/transactions, GET /v1/transactions/{lookupKey}, and GET /v1/transactions/{lookupKey}/status require a valid x-api-key. The key scopes returned tracking data to its associated integrator. Use the API key only from your backend. If your product exposes transaction history to end users, authorize those users in your own backend before forwarding a tracking request to Delora.

​
Need Higher Limits?

If you’re building a high-volume integration or a production-grade product, we’re happy to support your scaling needs. Please Contact Us for more details.