Covalent Authentication: API Key Setup and Security (2026)

Authentication overview

Covalent provides a Unified API designed to aggregate blockchain data from various networks. Access to this API is secured primarily through API keys. These keys serve as a credential presented with each request to verify the identity of the client and to ensure that the request is authorized within the scope of the user's account and subscription plan. The authentication mechanism ensures that only legitimate and authorized applications can consume Covalent's data services.

The Covalent API key is a unique token that identifies your application. When you make a request to the Covalent API, your API key must be included, typically as a query parameter in the request URL. This method allows Covalent to track API usage, enforce rate limits, and provide access to features associated with your account tier, such as the Covalent Free Tier, which offers up to one million API calls per month.

Using API keys for access control is a common practice for web APIs, offering a balance between ease of implementation and security, particularly when combined with other security measures like HTTPS/TLS encryption and strict key management practices Google Maps API Key usage.

Supported authentication methods

Covalent's primary method for API authentication is the use of API keys. This approach simplifies client-side integration while maintaining a level of security appropriate for public and commercial API access.

API Key Authentication

With API key authentication, a unique key is generated and linked to your Covalent account. This key is embedded directly into your API requests. Covalent's servers then validate this key against their system to authenticate the request. This method is suitable for server-to-server communication where the key can be kept confidential, and for client-side applications where the key's exposure is managed through domain restrictions or proxy servers.

How it works:

1. You generate an API key through your Covalent dashboard.
2. You include this API key in every request to the Covalent API, usually as a query parameter (e.g., ?key=YOUR_API_KEY).
3. Covalent validates the key and processes the request if the key is valid and authorized.

Covalent emphasizes that API keys should be treated as sensitive credentials. Their exposure could lead to unauthorized access to your account's API usage, potentially incurring charges or exceeding rate limits. More advanced authentication methods like OAuth 2.0 or mutual TLS are not directly offered for core API access, making API key security management critical.

Authentication Methods Summary

The following table summarizes the authentication method supported by Covalent, alongside its typical use cases and security considerations.

Getting your credentials

To authenticate requests with Covalent, you first need to obtain an API key. This process is managed through the Covalent platform's user dashboard.

Steps to get your Covalent API Key:

1. Account Creation: If you don't already have one, create an account on the Covalent website.
2. Login: Log in to your Covalent dashboard.
3. Navigate to API Keys: Within the dashboard, locate the section related to API keys or developer settings. The exact navigation may vary but typically involves a menu item labeled 'API Keys', 'Settings', or 'Developer'. Refer to the Covalent documentation for specific instructions.
4. Generate New Key: Click on the option to generate a new API key. You might be prompted to give your key a descriptive name to help with organization, especially if you plan to use multiple keys for different applications.
5. Record Your Key: Once generated, your API key will be displayed. It is crucial to copy and store this key securely immediately. Covalent may not display the full key again for security reasons after its initial generation.

Each API key is unique to your account and grants access to Covalent's API according to your subscription plan. It is advised to generate separate keys for different applications or environments (e.g., development, staging, production) to facilitate easier revocation if a key is compromised.

Authenticated request example

After obtaining your API key, you can use it to make authenticated requests to the Covalent API. The key is typically passed as a query parameter named key in the request URL.

Example using cURL:

This cURL example demonstrates how to retrieve the historical transactions for a wallet address on the Polygon chain using your API key. Replace YOUR_API_KEY with your actual Covalent API key and YOUR_WALLET_ADDRESS with the wallet address you wish to query.

curl -X GET \
  'https://api.covalent.xyz/v1/polygon-mainnet/address/YOUR_WALLET_ADDRESS/transactions_v2/?key=YOUR_API_KEY' \
  -H 'Content-Type: application/json'

Example using Python:

Covalent supports various SDKs, including Python. The following Python example uses the requests library to make an authenticated call.

import requests

api_key = "YOUR_API_KEY"
wallet_address = "YOUR_WALLET_ADDRESS"
chain_id = "polygon-mainnet"

url = f"https://api.covalent.xyz/v1/{chain_id}/address/{wallet_address}/transactions_v2/?key={api_key}"

headers = {
    "Content-Type": "application/json"
}

response = requests.get(url, headers=headers)

if response.status_code == 200:
    print(response.json())
else:
    print(f"Error: {response.status_code} - {response.text}")

Example using JavaScript (Node.js with fetch):

For JavaScript environments, particularly Node.js, you can use the built-in fetch API or a third-party library like axios.

const apiKey = "YOUR_API_KEY";
const walletAddress = "YOUR_WALLET_ADDRESS";
const chainId = "polygon-mainnet";

const url = `https://api.covalent.xyz/v1/${chainId}/address/${walletAddress}/transactions_v2/?key=${apiKey}`;

fetch(url, {
  method: 'GET',
  headers: {
    'Content-Type': 'application/json'
  }
})
.then(response => {
  if (!response.ok) {
    throw new Error(`HTTP error! status: ${response.status}`);
  }
  return response.json();
})
.then(data => {
  console.log(data);
})
.catch(error => {
  console.error('Fetch error:', error);
});

Remember to replace placeholders with your actual API key and desired wallet address or other parameters. For production applications, avoid hardcoding API keys directly in client-side code, consider using environment variables or server-side proxies to manage keys securely.

Security best practices

Securing your API keys is crucial for maintaining the integrity of your applications and preventing unauthorized access to your Covalent account. Adhering to these best practices will help protect your credentials.

1. Keep API Keys Confidential: Treat your API key as you would a password. Never embed it directly in client-side code that could be publicly exposed (e.g., JavaScript in a web browser without proper proxying). Store keys in environment variables or a secure configuration management system on your server.
2. Use HTTPS/TLS: Always ensure that your API calls to Covalent are made over HTTPS. This encrypts the communication channel, protecting your API key and data from interception during transit. Covalent's API endpoints are designed to be accessed via HTTPS Covalent API reference.
3. Restrict API Key Usage (if applicable): While Covalent's dashboard might not offer granular IP or domain restrictions for API keys directly at the time of writing, if such features become available, utilize them. Restricting where a key can be used significantly reduces the risk if it is compromised. Regularly check Covalent's changelog for new security features.
4. Rotate API Keys Regularly: Periodically generate new API keys and revoke old ones. This practice minimizes the window of opportunity for a compromised key to be exploited. A common rotation schedule is every 90 days.
5. Implement Server-Side Access: For client-side applications (e.g., single-page applications), route all Covalent API requests through your own backend server. Your server can then append the API key before forwarding the request to Covalent, keeping the key hidden from end-users.
6. Monitor API Usage: Regularly check your Covalent dashboard for unusual API usage patterns. Spikes in requests or usage from unexpected regions could indicate a compromised key.
7. Error Handling and Logging: Implement robust error handling for API requests. Log authentication failures securely for auditing purposes, but avoid logging the API key itself.
8. Environment Variables: Store API keys in environment variables rather than hardcoding them in your source code. This practice is essential for deployment across different environments (development, staging, production) and prevents keys from being committed to version control systems like Git.

By following these best practices, developers can significantly enhance the security posture of their applications interacting with the Covalent API, protecting both their data and their Covalent account.