Developer docs

Documentation

Start here for wallet sign-in and RPC integration. Authenticate your requests, call the endpoints, handle error codes, and see how billing works. Every example runs as-is.

Create an API key JSON-RPC reference Webhook signature verification

Start here

The three product lines serve different audiences, and onboarding effort varies widely. Pick one path and follow it — do not read all three at once.

I just want to check approvals

No sign-up, no API key: paste an address and scan. Revocations are signed by your own wallet, and you pay the gas.

I want to add RPC

Sign up, create an API key, and swap your old endpoint. No client code changes.

I want to add wallet sign-in

This one takes code: install the SDK, issue challenges from your server, and keep the billing key server-side. The wallet just signs.

Integrating RPC in four steps

Make your first call in five minutes. All examples use cs_live_xxx as a placeholder.

1

Create an API key Create it on the API Keys page in the console and select the scopes you need (rpc / data / webhook / read). The plaintext key is shown only once.

2

Store the key in a server-side environment variable For example CS_API_KEY=cs_live_xxx. Never hardcode keys in clients: a key in browser or mobile code is public by definition.

3

Make your first request Use POST /rpc/{chain} to call JSON-RPC. Available networks are listed on the Supported Networks page.

4

Wire up usage and alerts Track CU usage and error rates in the console. Configure a webhook to receive alert and billing events.

First request (curl)

curl -sS https://YOUR-GATEWAY-DOMAIN/rpc/ethereum \
  -H "Authorization: Bearer cs_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}'

# response
# { "jsonrpc": "2.0", "id": 1, "result": "0x1463b96" }

Replace YOUR-GATEWAY-DOMAIN with the gateway domain your deployer provides.

Never hardcode keys in clients

Front-end code may only hold the public project_id(used only by ChainBridge Connect). If any cs_live_xxx key is leaked, disable it in the console right away — it takes effect globally within 30 seconds.

Authentication methods

Method	Headers	Use cases
Customer API key	Authorization: Bearer cs_live_<prefix>_<secret>	RPC / Data API / Webhook management
Admin session	Authorization: Bearer <session_token>	Console sign-in session
No auth	—	Public data such as the status page

Disabling keys and adjusting limits or routing take effect globally within 30 seconds.

Response envelope

Success

{ "code": 1, "data": { }, "message": "Saved" }

Failure (message + reference ID)

{
  "code": 400004,
  "message": "This account lacks permission for that action. Ask your administrator to grant it.",
  "timestamp": 1761408000000
}

Every response includes X-Request-Id; share it with support when troubleshooting.

Browse by topic

JSON-RPC reference

Endpoints, batch requests, WebSocket subscriptions, method weights, and error codes.

Data API

Wallet assets, transaction history, NFTs, portfolio data, and archive queries.

Webhook signature verification

HMAC-SHA256 signing, timestamp checks, and backoff rules.

Connect SDK

Integration examples for multi-wallet connection, SIWE/SIWX auth, and session management.

Self-hosted gateway

Private deployment, config versioning, and offline degradation.

Billing rules

CU weights, quotas, plans, and overage.

Search the docs

Enter keywords to search endpoints, error codes, event types, and sections.

Core concepts

requestId: One per request, returned in X-Request-Id; retries do not change it and are never billed twice.
attemptId: One per attempt. Logged internally, never billed.
Compute unit (CU): The billing unit. Weights differ by RPC method and Data API endpoint, and every weight table is versioned with an effective date.
Billing period: Calendar month. Once invoiced the bill is locked and discrepancies go through adjustment notes only (returns 400501）。
Archive queries: Historical state and log queries, billed at archive CU weights (typically 5–20x) and enabled per chain.
Key digest: We store only the SHA-256 digest and prefix of each key. The plaintext key cannot be recovered.

Common issues

Make sure the key's scopes include the product you are calling (rpc / data), and confirm the source IP is within the allowed range (otherwise you get 400011). An admin can adjust team permissions on the Members and Permissions page.

Back off and retry after the suggested wait time in the response instead of resending immediately. If it keeps happening, check for overly frequent polling or batches split too finely.

Compare the block_number in the response with your own node's height; if it persists, open a ticket and include X-Request-Id。

Disable the key in the console right away — it takes effect globally within 30 seconds. Create a new key, switch traffic, then check the usage page for suspicious callers.