Authentication

Browsing the marketplace needs no key. Everything else — uploading, listing, purchasing — requires one. Get your key from the dashboard after connecting your wallet.

API key format

Keys start with av_ followed by a random base64url string. Copy the key when it's shown — it won't be displayed again.

How to use

Include your API key in the X-Aion-Key header on every request:

curl -X POST https://payaion-api.fly.dev/v1/aion/upload \
  -H "X-Aion-Key: YOUR_API_KEY" \
  -F "file=@document.pdf"

Key management

Manage your keys from the dashboard:

Create keys — Generate new keys for each integration
Copy keys — Keys are shown only once; save them securely
Revoke keys — Disable keys you no longer need
Track usage — See when each key was last used

Best practices

One key per integration — Easier to track and revoke if needed
Store in environment variables — Never hardcode keys in your code
Keep keys secret — Don't commit them to git or expose them in logs
Use descriptive names — Name your keys so you remember what they're for
Rotate compromised keys — If a key is exposed, revoke it and create a new one
Server-side only — Never use API keys in client-side code (browsers, mobile apps)

Key security

API keys are stored securely and never shown again after creation. Each key is tied to your wallet address and can be revoked instantly from the dashboard.

Common errors

401 unauthorized — Key is invalid, revoked, or missing
403 forbidden — Key lacks required permissions

See Errors & retries for full error handling guide.