Keys

Issue an API key with one wallet signature, and revoke it with the key itself.

Issued on: One signature
Gas: None
Active keys: 5 per wallet
Shown: Once

#Issue a key

A key is issued on one wallet signature. Signing sends no transaction and costs no gas. In the app, open Gateway and press Sign to issue API key: the app runs the steps below for you (Get a key).

01
Ask for a challenge
Send POST /v1/keys/challenge with the wallet’s address: {"address":"0x<wallet>"}. The answer holds a nonce and the message to sign.
02
Sign the message
The wallet signs the message exactly as given, as a personal message (personal_sign). A smart-contract wallet’s signature is accepted too.
03
Send the signature
Send POST /v1/keys with address, nonce and signature. The answer holds the key, its prefix and the base_url.
04
Store the key
The key is shown once, in that answer. Keep it where you keep passwords.

The message names the site that asks, the wallet, the chain and the nonce. Read it in the wallet before you sign:

The message

app.kyzen.network asks this wallet to sign for a Kyzen Network Gateway API key.

Wallet: 0x<your wallet, in lowercase>
Chain ID: 4663
Nonce: <32 hexadecimal characters>

Signing sends no transaction and costs nothing.

Issue a key

# 1. Ask for a challenge
curl https://app.kyzen.network/v1/keys/challenge \
  -H "Content-Type: application/json" \
  -d '{"address":"0xYourWallet"}'

# 2. Sign its message with the wallet, then send the signature
curl https://app.kyzen.network/v1/keys \
  -H "Content-Type: application/json" \
  -d '{"address":"0xYourWallet","nonce":"<nonce>","signature":"0x<signature>"}'

Rule	Value
Challenge	Valid for 10 minutes, for one wallet, used once
Key	`kyzn_` followed by 43 characters
Prefix	The key’s first 11 characters, which name it in `GET /v1/account`
Stored	Only the key’s SHA-256 hash: the Gateway cannot show the key again
Per wallet	At most 5 active keys
Shared	Every key of a wallet spends the same balance and shares the same limits
Regions	Both requests follow the app’s region rule (Where the app opens)

A refused request names its case. Every error, in full: Errors.

Status	Code	When
400	`invalid_wallet`	The address is not a 0x wallet address
400	`invalid_signature`	The nonce is missing, or the signature is not 0x hex
400	`challenge_expired`	The challenge is unknown, used, older than 10 minutes or another wallet’s: ask for a new one
401	`invalid_signature`	The signature is not this wallet’s signature of the message
409	`too_many_keys`	The wallet already has 5 active keys. The challenge is used: revoke a key, then ask for a new challenge

#Revoke a key

A key revokes itself: send DELETE /v1/keys/current with the key in the Authorization header. It stops working at once, and the answer reads {"object":"kyzen.key","revoked":true}.

Revoke the key

curl -X DELETE https://app.kyzen.network/v1/keys/current \
  -H "Authorization: Bearer $KYZN_KEY"

After revoking	Rule
The key	Every request with it answers 401 `invalid_api_key`
The balance	Unchanged: it belongs to the wallet, not to the key
Other keys	Keep working
A new key	One more signature issues it, up to 5 active

Revoking takes the key itself. Keep each key until you revoke it: a lost key stays active and counts toward the wallet’s five. GET /v1/account lists the active keys by id, prefix and the time each was created (Endpoints).