Chainpoint Authentication: API Access & Security Practices (2026)

Authentication overview

Chainpoint provides a method for timestamping data on the Bitcoin blockchain, offering verifiable proof of existence for digital assets. Access to the Chainpoint API, Chainpoint Client (Node.js), and Chainpoint CLI requires authentication to track usage and enforce service limits. The primary authentication mechanism for Chainpoint services is the use of API keys.

API keys serve as tokens that identify and authorize requests from your application or service. These keys are associated with your Chainpoint developer account and dictate the level of access and usage quotas applied to your requests. All communication with the Chainpoint API must occur over HTTPS to ensure the confidentiality and integrity of data in transit, protecting API keys and other sensitive information from interception.

Chainpoint's authentication model is designed for straightforward integration, allowing developers to quickly begin timestamping data without complex setup. The system ensures that each request is attributable to a specific account, which is essential for managing free tier usage (first 100 anchors per month free) and tiered pricing plans, such as the Developer Plan starting at $5/month for 1,000 anchors.

For securing API keys, Chainpoint recommends practices common to other API-driven platforms, emphasizing the importance of treating API keys as sensitive credentials. This includes avoiding hardcoding keys directly into source code and using environment variables or secure configuration stores instead. The overall approach aligns with common industry practices for API security, where a secret key grants access to resources and operations.

Supported authentication methods

Chainpoint primarily supports API key authentication for accessing its services. This method is suitable for server-to-server communication and client-side applications where the API key can be securely managed.

API keys are unique alphanumeric strings generated through the Chainpoint developer portal. When a request is made to the Chainpoint API, this key is included in the request headers or body to identify the sender. Each API key is linked to a specific developer account, allowing Chainpoint to enforce usage limits and apply correct billing based on the pricing model, which offers a free tier for the first 100 anchors per month and tiered pricing thereafter.

The simplicity of API key authentication makes it a common choice for many API providers, particularly when the primary goal is resource access control rather than user-specific identity verification. For example, Stripe uses API keys for authenticating requests to its payment processing API, and Twilio utilizes API keys for accessing its communication services. While straightforward, the security of API keys heavily relies on how they are stored and managed by the developer.

Getting your credentials

To obtain your Chainpoint API credentials, you must register for a developer account on the Chainpoint platform. The process involves creating an account and then navigating to the developer dashboard or settings section where API keys are generated and managed.

1. Create a Chainpoint Account: Visit the official Chainpoint website and sign up for a new developer account. This typically involves providing an email address and creating a password.
2. Access the Developer Portal: After successful registration and login, navigate to the developer portal or dashboard. The exact location may vary, but it is commonly labeled as "API Keys," "Developer Settings," or "Dashboard."
3. Generate an API Key: Within the developer portal, you will find an option to generate a new API key. Chainpoint provides a straightforward interface for this, often with a single button click. New keys are typically long, randomly generated strings of characters designed to be difficult to guess.
4. Copy and Secure Your Key: Once generated, your API key will be displayed. It is crucial to copy this key immediately and store it in a secure location. Chainpoint often displays the key only once for security reasons, meaning you might not be able to retrieve it again if lost. If lost, you would typically generate a new key and revoke the old one.
5. Configure Your Application: Integrate the copied API key into your application or service. This usually involves setting it as an environment variable, storing it in a configuration file, or using a secrets management service. Avoid embedding the key directly into your source code.

Chainpoint's documentation provides specific instructions and examples for setting up your environment with the API key, particularly for the Chainpoint Client (Node.js). This ensures that your applications can correctly authenticate with the Chainpoint API to submit data for timestamping and retrieve proofs.

Authenticated request example

Authenticating requests to the Chainpoint API involves including your API key in the request headers. The following example demonstrates how to submit a hash for timestamping using curl, which is a common method for interacting with RESTful APIs:

curl -X POST \
  https://api.chainpoint.org/hashes \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_CHAINPOINT_API_KEY' \
  -d '{
    "hashes": [
      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    ]
  }'

In this example:

• -X POST specifies the HTTP method as POST.
• https://api.chainpoint.org/hashes is the Chainpoint API endpoint for submitting hashes.
• -H 'Content-Type: application/json' sets the content type of the request body.
• -H 'Authorization: Bearer YOUR_CHAINPOINT_API_KEY' is the critical authentication header. Replace YOUR_CHAINPOINT_API_KEY with the actual API key you obtained from your Chainpoint developer portal. The Bearer scheme is a standard method for transmitting tokens in HTTP requests, as specified by RFC 6750 for OAuth 2.0 Bearer Token Usage.
• -d '...' provides the request body as JSON, containing an array of hashes to be timestamped. In this case, e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 is the SHA256 hash of an empty string.

Upon successful authentication and submission, the API will return a response indicating that the hashes have been accepted for processing. For more detailed examples and information on specific API endpoints, refer to the Chainpoint API reference.

Security best practices

Securing your Chainpoint API keys is essential to prevent unauthorized access to your account and maintain the integrity of your timestamping operations. Adhering to the following best practices can mitigate common security risks:

1. Treat API Keys as Sensitive Credentials: Your API key grants access to your Chainpoint account and its associated usage quota. Treat it with the same level of security as you would a password or private key.
2. Do Not Embed Keys Directly in Code: Avoid hardcoding API keys directly into your application's source code. This practice can lead to accidental exposure if the code is publicly shared or compromised. Instead, use environment variables, configuration files, or a dedicated secrets management service. For example, cloud providers offer services like AWS Secrets Manager or Google Cloud Secret Manager for secure storage of API keys.
3. Use Environment Variables for Server-Side Applications: When deploying server-side applications, configure your API key as an environment variable. This keeps the key separate from your codebase and allows for easy rotation without code changes.
4. Restrict Access to API Keys: Limit who has access to your API keys. Only authorized personnel should be able to view or modify these credentials. Implement appropriate access controls on systems where keys are stored.
5. Rotate Keys Regularly: Periodically generate new API keys and revoke old ones. Regular key rotation minimizes the window of opportunity for a compromised key to be exploited.
6. Monitor API Usage: Keep an eye on your Chainpoint account's API usage. Unusual spikes in activity could indicate unauthorized use of your API key. Chainpoint's developer portal may offer tools for monitoring usage.
7. Use HTTPS for All API Calls: Ensure that all communication with the Chainpoint API uses HTTPS (HTTP Secure). This encrypts data in transit, protecting your API key and other sensitive information from eavesdropping and man-in-the-middle attacks. Chainpoint's API endpoints are designed to only accept HTTPS connections.
8. Implement Least Privilege: If Chainpoint introduces features allowing for different scopes or permissions for API keys, configure your keys with the minimal necessary permissions required for your application to function. This limits the potential damage if a key is compromised.
9. Educate Developers: Ensure all developers working with the Chainpoint API understand and follow these security best practices. Consistent adherence across the development team is crucial for maintaining a strong security posture.
10. Secure Local Development Environments: Even in development, be mindful of how API keys are handled. Avoid committing them to version control systems like Git, and use local environment variables or .env files that are excluded from repository tracking.

By implementing these measures, developers can significantly enhance the security of their Chainpoint integrations, protecting both their data and their account resources.