​
No bearer tokens

The testnet does not require API keys or bearer tokens. Identity is the transaction signature itself: if the signed tx recovers to a valid address, the call is authorized. This is true for:
  • eth_sendRawTransaction — client signs locally, RPC just relays.
  • yc_sendTransaction — the RPC signs for you, and therefore requires a privateKey in the request (Missing 'privateKey' field if absent). It exists for scripts and fixtures using the public test keys. Never call it with a real user’s key: the key travels to the node, in plaintext over the wire. An app signs on device and uses eth_sendRawTransaction.
  • All read endpoints — no auth at all.

​
Mobile REST: no key, ever

The mobile endpoints need no key from your app. You send the acting address; the indexer builds the calldata and relays the transaction through its own oracle wallet.
POST /api/mobile/engagement
Older documentation and older clients passed a privateKey field here. The indexer ignores it — it has always signed with the oracle wallet. If you find that field in an existing client, delete it: a real user’s key must never leave the device. For actions the user must authorise themselves (a swap, a transfer), sign on device and submit via eth_sendRawTransaction — see Wallet Integration.

​
Rate limiting

The global rate limit (300 req/min per IP) is shared between JSON-RPC and REST. Hitting it returns HTTP 429 with Retry-After. Writes have a stricter 30 req/min cap.

​
CORS

All endpoints allow CORS from any origin on testnet. On mainnet, origins will be whitelisted via the gateway.