Skip to content
PROBORA

Getting Started

Authentication

Authenticate every request with a secret API key sent as a Bearer token.

Bearer tokens

Authenticate every request by sending your secret API key in the Authorization header using the Bearer scheme. Requests without a valid key receive 401 unauthorized.

Header
Authorization: Bearer prb_live_…

Key format

Keys start with prb_live_ followed by 32 base62 characters (A–Z, a–z, 0–9). The first characters form a non-secret prefix that identifies the key in the dashboard; the rest is secret.

PartExampleMeaning
prb_prb_Probora key marker.
live_live_Environment. Production keys use live.
secret8hJ2••••••••••••••••••••••••a9Fq32 random base62 characters. Shown in full exactly once.

Authenticated request

# export PROBORA_API_KEY=prb_live_…
curl "https://api.probora.xyz/v1/consensus/BTC/15m" \
  -H "Authorization: Bearer $PROBORA_API_KEY"

Security practices

Keep keys on the server

Never ship a secret key in a browser, mobile app or public repository, where anyone can extract it. Call the API from your own backend and forward only the data your clients need.
  • Store keys in environment variables or a secret manager, never in source code.
  • Create one named key per integration so each can be revoked independently.
  • Rotate keys periodically and immediately revoke any key that may have been exposed.
  • Only call the API over HTTPS; requests over plain HTTP are rejected.
  • Log the request id of failed calls, never the key itself.

Authentication errors

CodeStatusMeaning
unauthorized401Unauthorized. The API key is missing, malformed or revoked.
plan_required403Plan required. Your plan does not include this endpoint or history depth.
Response · 401
{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key.",
    "status": 401,
    "request_id": "req_01JD3ZQ8M4F2K7W9"
  }
}

Questions or feedback on the API? [email protected]