> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nowramp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How authentication works with the NowRamp Onramp API

# Authentication

The NowRamp Onramp API is designed for simplicity — most endpoints are public and don't require an API key.

## Onramp API (Public)

All Onramp API endpoints (`/public/v1/onramp/*`) are **public**. Pass your `projectId` as a query parameter or in the request body:

```javascript theme={null}
// No API key needed
const quotes = await fetch(
  'https://api.nowramp.com/public/v1/onramp/quotes?projectId=your_project_id&fiatCurrency=USD&cryptoCurrency=ETH&network=ethereum&fiatAmount=100'
).then(r => r.json());
```

## Optional: Public Key for Higher Rate Limits

By default, public endpoints are rate-limited to 60 requests per minute. To increase this to 1000 requests per minute, include a public key (`pk_`) in the `X-API-Key` header:

```bash theme={null}
curl "https://api.nowramp.com/public/v1/onramp/quotes?projectId=YOUR_PROJECT_ID&fiatCurrency=USD&cryptoCurrency=ETH&network=ethereum&fiatAmount=100" \
  -H "X-API-Key: pk_live_your_public_key"
```

Public keys (`pk_`) are safe to use in frontend code.

## API Key Types

| Key Prefix | Type              | Usage                                       |
| ---------- | ----------------- | ------------------------------------------- |
| `pk_live_` | Public Key (Live) | Frontend — optional, for higher rate limits |
| `pk_test_` | Public Key (Test) | Frontend — sandbox environment              |
| `sk_live_` | Secret Key (Live) | Backend only — partner dashboard operations |
| `sk_test_` | Secret Key (Test) | Backend only — sandbox                      |

<Warning>
  **Secret keys (`sk_`) must never be exposed in client-side code.** They are only needed for partner dashboard operations (webhook management, API key rotation, etc.), not for the Onramp API.
</Warning>

## Getting Your Keys

1. Log in to your [Partner Dashboard](https://dashboard.nowramp.com)
2. Navigate to **Settings > API Keys**
3. Copy your project ID and public key

See the [Partner Dashboard guide](/guides/partner-dashboard) for more details.

## Environments

| Environment | Key Prefix              | API URL                           |
| ----------- | ----------------------- | --------------------------------- |
| Production  | `pk_live_` / `sk_live_` | `https://api.nowramp.com`         |
| Sandbox     | `pk_test_` / `sk_test_` | `https://api.sandbox.nowramp.com` |

## Security Best Practices

### Store Keys in Environment Variables

```bash theme={null}
# .env (never commit this file)
NEXT_PUBLIC_NOWRAMP_PROJECT_ID=your_project_id
NEXT_PUBLIC_NOWRAMP_PUBLIC_KEY=pk_live_abc123xyz789
```

```javascript theme={null}
const api = new RampApi({
  projectId: process.env.NEXT_PUBLIC_NOWRAMP_PROJECT_ID,
  apiKey: process.env.NEXT_PUBLIC_NOWRAMP_PUBLIC_KEY  // Optional
});
```

### Key Rotation

Rotate your API keys periodically via the Partner Dashboard:

1. Go to **Settings > API Keys**
2. Click **Roll** next to the key
3. Update your application configuration
4. The old key remains valid for 24 hours (grace period)

## Error Codes

| Error Code            | HTTP Status | Description                                              |
| --------------------- | ----------- | -------------------------------------------------------- |
| `INVALID_API_KEY`     | 401         | API key is invalid or revoked                            |
| `RATE_LIMIT_EXCEEDED` | 429         | Too many requests — add a `pk_` key or implement backoff |

## Next Steps

* [Onramp API](/api/onramp) — Full endpoint documentation
* [Callback URLs](/guides/callback-urls) — Set up transaction notifications
* [Partner Dashboard](/guides/partner-dashboard) — Manage keys and configuration