Getting started

Authentication

API-key auth via the x-api-key header.

Every authenticated REST request must include your API key in the x-api-key header:

curl https://api.cheddar.biz/v1/mints \
  -H "x-api-key: YOUR_API_KEY"
  • Get your key from the dashboard — see API keys. Your organization has one active key; rolling it replaces the old one.
  • Missing or invalid key → 401 Unauthorized.
  • Every endpoint in this reference requires the key. Send it server-side only.

IP allowlisting (optional)

If your organization has IP allowlisting configured, requests from non-allowlisted IPs are rejected with 403 Forbidden. Contact the Cheddar team to manage your allowlist.

Treat your API key like a password. It grants full access to move funds. Never embed it in client-side code — call the API only from your backend.