Generate and manage API keys for authenticating with the Passkallet BaaS API.

API Keys

What is an API Key?

An API key is a secret string that identifies your application to the Passkallet API. Every request you make must include this key. Without it, the API returns a 401 Unauthorized error.

API keys look like this:

pk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4

They always start with pk_live_ followed by 48 random hex characters.

How to Generate an API Key

Step 1: Go to Your Organization

In the Passkallet dashboard, navigate to Settings then Organizations and select your organization.

Step 2: Open API Keys Section

Inside your organization page, find the API Keys section.

Step 3: Create a New Key

Click Generate API Key. You will be asked to:

Field	Description	Required
Name	A name so you remember what this key is for (max 100 chars)	Yes
Scopes	What this key is allowed to do (at least one required)	Yes
Rate Limit	Requests per minute (default: 60, max: 10,000)	No
Expiration	Optional expiration date (ISO 8601 format)	No

Step 4: Copy Your Key

The full API key is shown only once. Copy it immediately and store it somewhere safe (like a .env file or a secrets manager). If you lose it, you cannot retrieve it. You will need to generate a new one.

Scopes

Scopes control what an API key is allowed to do. Available scopes:

Scope	What It Allows
`wallet:create`	Create new wallets for the organization
`wallet:read`	List wallets, get wallet details, check balances, get wallet user info, resolve tokens
`token:transfer`	Prepare ERC-20 transfer transactions
`token:approve`	Prepare ERC-20 approve transactions
`transaction:read`	View transaction history for organization wallets
`transaction:execute`	Execute signed transactions through the relayer
`passkey:manage`	List on-chain recovery passkeys for wallets
`domain:read`	View domain info and list allowed tokens

Best practice: Give each API key only the scopes it needs. For example, if your backend only needs to display balances, give it wallet:read and nothing else.

Using Your API Key

Include the key in the x-api-key header of every request.

bash

curl https://gateway.dev.passkallet.com/sepolia/api/v1/passkallet/baas/wallets \
  -H "x-api-key: pk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4"

javascript

const API_KEY = process.env.PASSKALLET_API_KEY;
const BASE_URL = "https://gateway.dev.passkallet.com/sepolia/api/v1/passkallet/baas";

const response = await fetch(`${BASE_URL}/wallets`, {
  headers: {
    "x-api-key": API_KEY,
  },
});

const { statusCode, content } = await response.json();
console.log(content); // Array of wallets

Security Rules

Never expose your API key in frontend code. Always call the Passkallet API from your backend server.
Store keys in environment variables, not in source code.
Rotate keys regularly. You can have multiple active keys, so create a new one before revoking the old one.
Use the minimum scopes needed. A key with wallet:read cannot execute transactions.

Revoking a Key

Go to your organization's API Keys section
Find the key you want to revoke
Click Revoke

The key stops working immediately. Any request using that key will get a 401 Unauthorized error.