> ## Documentation Index
> Fetch the complete documentation index at: https://docs.winnieswap.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Managing and using API keys in Winnie

API keys are essential for authenticating and accessing Winnie's services. This guide explains how to manage and use your API keys effectively.

## Understanding API Keys

API keys serve as your authentication credentials when making requests to Winnie's services. Each key is associated with your account and plan, determining your rate limits and permissions.

<Note>
  Protect your API keys like passwords. Never expose them in client-side code or public repositories.
</Note>

## Key Types

<CardGroup cols={3}>
  <Card title="Standard API Key" icon="key" iconType="duotone">
    General-purpose keys for accessing all services
  </Card>

  <Card title="Restricted API Key" icon="shield-check" iconType="duotone">
    Keys with limited permissions for specific services
  </Card>

  <Card title="Dedicated API Key" icon="key-skeleton" iconType="duotone">
    High-performance keys for dedicated nodes
  </Card>
</CardGroup>

## Generating an API Key

<Steps>
  <Step title="Log in to your Winnie Dashboard">
    Visit [dashboard.henlo-winnie.dev](https://dashboard.henlo-winnie.dev/) and sign in to your account
  </Step>

  <Step title="Navigate to API Keys section">
    Find the "API Keys" section in the dashboard menu
  </Step>

  <Step title="Generate a new key">
    Click the "Generate New Key" button and provide a name for your key
  </Step>

  <Step title="Set permissions (optional)">
    If creating a restricted key, select the specific permissions
  </Step>

  <Step title="Copy and store securely">
    Copy your new API key and store it securely - you won't be able to view it again
  </Step>
</Steps>

## Using API Keys

### In the URL

```bash theme={null}
curl -X POST https://api.henlo-winnie.dev/v1/mainnet/YOUR_API_KEY \
  -H "Content-Type: application/json" \
  --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
```

## Security Best Practices

<Accordion title="Keep your API key confidential">
  Never expose your API keys in client-side code, public repositories, or insecure locations.
</Accordion>

<Accordion title="Rotate keys regularly">
  Periodically generate new API keys and deprecate old ones, especially for production environments.
</Accordion>

<Accordion title="Use environment variables">
  Store API keys in environment variables rather than hardcoding them in your application.
</Accordion>

<Accordion title="Implement IP restrictions">
  Restrict API key usage to specific IP addresses for enhanced security.
</Accordion>

<Accordion title="Use the principle of least privilege">
  Create keys with only the permissions they need for their specific use case.
</Accordion>

## Permissions

API keys can be configured with granular permissions:

| Permission  | Description                                    |
| ----------- | ---------------------------------------------- |
| `rpc`       | Access to RPC endpoints                        |
| `webhooks`  | Ability to create and manage webhooks          |
| `analytics` | Access to analytics data                       |
| `admin`     | Administrative capabilities (use with caution) |

## Monitoring and Analytics

Monitor your API key usage in the dashboard:

* Track request volume and patterns
* View historical usage data
* Set up alerts for unusual activity
* Identify performance bottlenecks

## Troubleshooting

<Accordion title="API key not working">
  Verify that you're using the correct API key and that it hasn't been revoked. Check for typos in the key string.
</Accordion>

<Accordion title="Receiving authentication errors">
  Ensure you're sending the API key correctly in the URL.
</Accordion>

<Accordion title="Rate limit exceeded">
  Check your current plan's rate limits. Consider upgrading your plan or implementing rate limiting on your side.
</Accordion>