Authentication
Pass your SWQoS API key over HTTP or QUIC.
Contact support for an API key. Keys start with zc_live_ followed by 24 ASCII letters or digits.
HTTP
Use one of these forms:
| Precedence | Form | Example |
|---|---|---|
| 1 | Query parameter | https://sol.zerocopy.sh/?api-key=YOUR_KEY |
| 2 | Header | x-api-key: YOUR_KEY |
| 3 | Header | Authorization: Bearer YOUR_KEY |
The first form present wins, even if its value is empty or invalid. Bearer is case-sensitive. Prefer a header to avoid putting the key in URL logs.
curl -sS 'https://sol.zerocopy.sh' \
-H "x-api-key: $SWQOS_API_KEY" \
-H 'content-type: application/json' \
--data '{"jsonrpc":"2.0","id":1,"method":"getTipAccounts"}'All HTTP routes need a key except GET /health. Use HTTPS and keep the key in server-side code. Hosted endpoints do not provide CORS headers.
QUIC
Put the key in the client certificate's first common name (CN). A self-signed certificate works. Offer ALPN zerocopy-swqos/1 and verify the server certificate against the hostname you connect to.
See the QUIC connection setup and example.
Declared tips
Using a key does not enable declared tips. Arrange declared-tip access and payment with support first.
Refusals
A missing, unknown or revoked key returns unauthorized:
| Interface | Result |
|---|---|
| JSON-RPC | HTTP 401, code -32000, id: null |
| Raw HTTP | HTTP 401, JSON rejection body |
| QUIC connection | Application close code 8, reason unauthorized |
An overdue declared-tip payment returns payment_required on submissions. Queries remain available. Resolve the payment through your agreed billing setup or contact support.
Local agent
The agent uses the key in its licensed executable. Local HTTP, QUIC and IPC accept any key or none; a request header cannot switch the agent to another key. Restrict access to these listeners.