> ## Documentation Index
> Fetch the complete documentation index at: https://docs.delora.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate Limits and API Authentication

> Rate limits vary by authentication tier and endpoint scope. A valid x-api-key selects the authenticated limit tier.

## Current Rate Limits

#### Unauthenticated

| Endpoint Scope                                                                                                               | Rate Limit                 |
| ---------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
| <Tooltip tip="Includes /v1/quotes, /v1/advanced/routes, and /v1/advanced/stepTransaction"> Quote-related endpoints</Tooltip> | 200 requests per two hours |
| Rest of endpoints                                                                                                            | 200 requests per two hours |

#### Authenticated (with API key specified)

| Endpoint Scope                                                                                                               | Rate Limit              |
| ---------------------------------------------------------------------------------------------------------------------------- | ----------------------- |
| <Tooltip tip="Includes /v1/quotes, /v1/advanced/routes, and /v1/advanced/stepTransaction"> Quote-related endpoints</Tooltip> | 200 requests per minute |
| Rest of endpoints                                                                                                            | 200 requests per minute |

> Higher limits may be available for clients in the custom terms. Please [Contact Us](https://t.me/whoisfedelya) for more information.

Quote-related endpoints and other public endpoints use separate rate-limit scopes. A valid `x-api-key` selects the authenticated tier and may use a custom requests-per-minute limit configured for your integration.

If you exceed your rate limits, you’ll receive a `429 Too Many Requests` HTTP response.

## Rate Limit Headers

API responses include rate limit headers:

| Header                  | Description                                  |
| ----------------------- | -------------------------------------------- |
| `X-RateLimit-Limit`     | Request limit for the current window         |
| `X-RateLimit-Remaining` | Remaining requests in the current window     |
| `X-RateLimit-Reset`     | ISO timestamp when the current window resets |

## How to Get an API Key

To obtain an API key with higher rate limits, you need to register on the [portal.delora.build](https://portal.delora.build). After registration, your unique API key will be generated.

## Best Practices

To avoid hitting rate limits:

* Cache results from `GET /v1/tokens`, `GET /v1/chains`, `GET /v1/tools`, and other static metadata endpoints
* Avoid polling frequently for the same data
* Batch or debounce user input that triggers API calls

## Using the API key

<Note>
  Most Delora routing endpoints work without an API key, although an API key enables the authenticated tier. The Transaction Tracking API (`/v1/transactions*`) always requires a valid API key.
</Note>

Authentication to Delora API is performed via the custom HTTP header x-api-key with an API key.

Example:

```javascript theme={null}
curl --location 'https://api.delora.build/v1/quotes?senderAddress=0x26f1AA7356Fc05db2CdF6bE4C404dcE00e82Fe47&receiverAddress=0x26f1AA7356Fc05db2CdF6bE4C404dcE00e82Fe47&originChainId=1&destinationChainId=1&amount=1000000000000000000&originCurrency=0x0000000000000000000000000000000000000000&destinationCurrency=0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48' \
--header 'x-api-key: YOUR_CUSTOM_KEY'
```

<Danger>
  Never expose your x-api-key in client-side environments such as browser-based JavaScript. Using the API key on the client side can lead to unauthorized usage or abuse of your key, as it becomes publicly accessible in the browser’s developer tools or network tab. For server-side integrations (e.g. API requests from your backend), always keep your key secret and secure.
</Danger>

For browser-based widget integrations, keep the API key on your backend and proxy Delora requests server-side. The current `@deloraprotocol/widget` implementation supports this by letting you point `config.apiUrl` at your proxy instead of passing `apiKey` from the browser. See [Configure Widget](/widget/basic-setup/configure-widget).

## Transaction Tracking API

`GET /v1/transactions`, `GET /v1/transactions/{lookupKey}`, and `GET /v1/transactions/{lookupKey}/status` require a valid `x-api-key`. The key scopes returned tracking data to its associated integrator.

Use the API key only from your backend. If your product exposes transaction history to end users, authorize those users in your own backend before forwarding a tracking request to Delora.

## Need Higher Limits?

If you’re building a high-volume integration or a production-grade product, we’re happy to support your scaling needs.
Please [Contact Us](https://t.me/whoisfedelya) for more details.