> ## Documentation Index
> Fetch the complete documentation index at: https://docs.txshield.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to generate and use your TxShield API key

## Overview

All TxShield analysis endpoints require an API key. There is no unauthenticated
public access to production endpoints.

Keys are free to generate, tied to your wallet address, and issued instantly —
no email signup, no credit card, no waitlist.

***

## Generating Your API Key

<Steps>
  <Step title="Go to the API Keys page">
    Head to [txshield.xyz/ApiRef](https://txshield.xyz/ApiRef)
  </Step>

  <Step title="Connect your wallet">
    Click **Generate API Key**. A Web3 wallet prompt will appear.
    Connect with MetaMask, Coinbase Wallet, or any WalletConnect-compatible wallet.
  </Step>

  <Step title="Sign the message">
    You will be asked to sign a message to prove wallet ownership.
    This is a **free, gas-less signature** — nothing is sent on-chain,
    no transaction is made.
  </Step>

  <Step title="Copy your key">
    Your API key is generated instantly and displayed once.
    **Store it securely** — we do not store or show it again.
  </Step>
</Steps>

<Warning>
  Your API key is tied to your wallet address. If you lose your key,
  you can regenerate one by connecting the same wallet again.
</Warning>

***

## Using Your API Key

Pass your key in the `Authorization` header on every request using Bearer format.

```
Authorization: Bearer txs_your_api_key_here
```

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://api.txshield.xyz/api/simulate/execute-simulation \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer txs_your_api_key_here" \
    -d '{
      "targetContractAddress": "0x3e391e5cb8ea766c93134faf486e6393158032c2",
      "chainId": 1
    }'
  ```

  ```javascript JavaScript (fetch) theme={null}
  const response = await fetch(
    'https://api.txshield.xyz/api/simulate/execute-simulation',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Authorization': 'Bearer txs_your_api_key_here'
      },
      body: JSON.stringify({
        targetContractAddress: "0x3e391e5cb8ea766c93134faf486e6393158032c2",
        chainId: 1
      })
    }
  );
  const data = await response.json();
  ```

  ```python Python theme={null}
  import requests

  response = requests.post(
      "https://api.txshield.xyz/api/simulate/execute-simulation",
      headers={
          "Content-Type": "application/json",
          "Authorization": "Bearer txs_your_api_key_here"
      },
      json={
          "targetContractAddress": "0x3e391e5cb8ea766c93134faf486e6393158032c2",
          "chainId": 1
      }
  )
  data = response.json()
  ```

  ```typescript TypeScript theme={null}
  const res = await fetch(
    'https://api.txshield.xyz/api/simulate/execute-simulation',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Authorization': `Bearer ${process.env.TXSHIELD_API_KEY}`
      },
      body: JSON.stringify({
        targetContractAddress: "0x3e391e5cb8ea766c93134faf486e6393158032c2",
        chainId: 1
      })
    }
  );
  const data = await res.json();
  ```
</CodeGroup>

***

## Rate Limits

| Endpoint Type                                     | Free Tier Limit      |
| ------------------------------------------------- | -------------------- |
| `/api/simulate`, `/api/honeypot`, `/api/phishing` | 10 requests / minute |
| All other endpoints                               | 30 requests / minute |

Limits are applied **per API key**, tracked via a 60-second rolling window.

<Note>
  Need higher limits for a production integration? Reach out at
  `contactcodecommunity@gmail.com` or contact us on
  [X](https://x.com/txshield_) for a partner tier key.
</Note>

***

## Error Responses

### Missing API Key — `401`

```json theme={null}
{
  "success": false,
  "error": "Missing Authorization header"
}
```

### Invalid API Key — `403`

```json theme={null}
{
  "success": false,
  "error": "Invalid API key"
}
```

### Rate Limit Exceeded — `429`

```json theme={null}
{
  "success": false,
  "error": "Analysis rate limit hit. Max 10 requests per minute."
}
```

***

## Security Best Practices

**Never expose your API key in frontend code.** If you are building a
client-side app, proxy requests through your own backend and keep the key
in an environment variable server-side.

```bash theme={null}
# .env — server side only, never commit this
TXSHIELD_API_KEY=txs_your_api_key_here
```

**Rotate your key if compromised.** Visit [txshield.xyz/ApiRef](https://txshield.xyz/ApiRef),
connect the same wallet, and generate a new key. The old key is invalidated immediately.

***

<CardGroup cols={2}>
  <Card title="EVM Simulation" icon="ethereum" href="/evm-simulation-copied-1">
    Full reference for the simulation endpoint.
  </Card>

  <Card title="Honeypot Detection" icon="spider-web" href="/evm-honeypot-copied-1">
    Full reference for the honeypot endpoint.
  </Card>
</CardGroup>