# Authentication

> How AI agents authenticate against Tatum: pass your API key in the x-api-key header on every request. No OAuth flow. Where to store keys for MCP, apps, and CI.

- canonical: <https://ai.tatum.io/auth>
- html: <https://ai.tatum.io/auth>

## API key

Every call carries an API key in the `x-api-key` request header. Get one from the Tatum dashboard.

```http
GET /v4/data/wallet/portfolio?address=0x...&chain=ethereum-mainnet
Host: api.tatum.io
x-api-key: tatum_xxx
```

## Where the key lives

Read `TATUM_API_KEY` from the environment everywhere. Never commit it, and never put it in client-side code.

| Surface | Location | Note |
| --- | --- | --- |
| Blockchain MCP | env in your MCP client JSON | Lives in the editor config, never in the repo. |
| Backend app | .env or a secret manager | Server side only. The key is not public. |
| CI | GitHub Actions · GitLab · Vercel · Cloudflare | One key per environment, so you can rotate one at a time. |
| Local shell | export TATUM_API_KEY=… | Fine for scratch work. Rotate the key when you are done. |

## Check it in one call

A JSON body means the key works. A 401 means the header is missing or wrong. A 429 means the request was rate limited.

```bash
curl -s -H "x-api-key: $TATUM_API_KEY" \
  "https://api.tatum.io/v4/data/exchange-rate?currency=ETH&basePair=USD"
```

- 200 — The key works: A JSON body comes back. Nothing else to do.
- 401 — Header missing or wrong: Check the spelling of x-api-key and that the variable resolved.
- 429 — Rate limited: Back off and retry. Do not hammer the API in a loop.