OceanAltOceanAlt

API keys

You can call us without signing up — everything that works today keeps working, with no code changes. A key raises your limits, and lets you lock it down: which capabilities it may call, which addresses it is accepted from, and when it stops working.

Requesting a key does not add you to a marketing list. We use this address only to issue the key and to send necessary account or security notices. If we ever want to send product or marketing email, we will ask for your consent separately.

The three levels

① Anonymous

60/min · 2,000 a month free

Every capability: address, endpoint and calldata screening, pre-payment decisions, batch, point-in-time lookups, signed evidence bundles

How:
Nothing to do — just call
We see:
Your IP, and nothing else. We attribute nothing.

② Registered

180/min · 5,000 a month free

The same capabilities, higher limits (counted per key)

How:
Leave an email, click the link in it
We see:
An email address and this key's usage counts (calls per month, last used). No per-call history is kept by default — records begin only if you switch decision logging on yourself, so you can export them for your own auditor.

③ KYA (Know Your Agent)

300/min · 50,000 a month free

The same capabilities, the highest limits (aggregated per owner, not multiplied per agent)

How:
Call with a registered agent credential
We see:
A linkable agent identity: registry record → mandate → this credential → this call. We verify that the chain is valid on our side, not who stands behind it.

What happens when you go over: we throttle, we do not cut off. We do not want a normal agent that has already integrated to suddenly stop working just because a free allowance ran out. Past the allowance it simply slows down and resets on the 1st (UTC). Abuse, anomalous automation, security risk and violations of the acceptable-use policy are excepted.

The third level needs no new key. If you already have an agent in the registry, just call with its credential — we won't make you apply twice for something you already hold. See the registry →

Why there are levels at all

We spend our days arguing one point: an agent that spends money should be linkable to a party that can take responsibility. The same principle should apply to us — it is hard to ask that of others while our own endpoints are fully anonymous with no attribution at all.

But we do not want heavyweight identity verification sitting in front of the first call. Low-risk, low-volume trial should stay open; as call volume and machine privilege rise, more complete identity and attribution are asked for step by step. So the anonymous level stays, permanently and free. Every level above it is opt-in, and the table above states both halves: what you gain, and what we learn.

Using the key

Put it in a header. We accept both spellings, because SDKs differ on this and it is not worth blocking anyone over.

A call with your key

curl -X POST "https://oceanalt.com/api/decide" \
  -H "authorization: Bearer $OCEANALT_API_KEY" \
  -H "content-type: application/json" \
  -d '{"to":"0x0000000000000000000000000000000000000000","amountUsdc":25}'

Every response carries an access block: which level you are on, what your limits are, and what the next level would add. An agent won't read the docs, but it will read the response.

If a key isn't recognised — mistyped, revoked, or email not yet verified — we don't quietly serve you at the anonymous level. The response says key_rejected and why. A silent downgrade makes you hunt through your own code for a problem that isn't there.

Full API documentation →

Three optional locks on a key

A key has no limits by default, and nothing about a key you already use changes because of this section. If you want them, you can add: which capabilities it may call, which network addresses it is accepted from, and a date after which it stops working. If a key ever leaks, these three decide how much can be done with it.

The key is used for this one request only: it is not stored in the page and never displayed. If this key has an IP allowlist, this page can only read it from an allowlisted network — otherwise change it from the command line on an allowlisted machine.

Looking for the other kind of key?

The key on this page is an API key. It governs how much you can call us and which capabilities you can use.

If what you want is a spending cap for an AI that pays on its own — how much per payment, how much per day, who it may pay — that is a different key, on a different page. Go there →

Our application database does not store the key itself, only its sha256 hash, and the system offers no way to view the plaintext again — a lost key is re-issued, not recovered. The key is a high-entropy random string. To be precise: at issuance the key travels by email, so the mail delivery path necessarily handles it — what we can guarantee is that no plaintext remains on our side.