Authentication overview

ZMOK secures access to its blockchain and crypto data APIs primarily through API key authentication. This mechanism requires developers to include a unique API key with every request made to the ZMOK API endpoints. The API key serves as a credential, verifying the identity of the requesting application and ensuring that only authorized entities can retrieve data, such as real-time market feeds or historical blockchain records ZMOK documentation portal. All communication with ZMOK APIs is expected to occur over HTTPS (TLS-encrypted) channels to protect data in transit, aligning with industry standards for secure web communication IETF RFC 8446 for TLS 1.3.

Proper management of API keys is crucial for maintaining the security and integrity of applications built on ZMOK. This includes practices such as storing keys securely, avoiding hardcoding them directly into public repositories, and rotating them periodically. ZMOK's developer portal provides tools for generating and managing these keys, enabling developers to control access and monitor usage effectively.

Supported authentication methods

ZMOK focuses on a streamlined authentication process, primarily leveraging API keys. This method is widely adopted for its simplicity and effectiveness in controlling access to web services.

Method When to Use Security Level
API Key All API requests to ZMOK for accessing blockchain and crypto market data. Standard. Requires secure storage and transmission.

API keys are typically passed as a header or query parameter in HTTP requests. While simple, the security of API keys depends heavily on how they are managed and transmitted. ZMOK recommends using environment variables or a secure configuration management system to store keys rather than embedding them directly in source code ZMOK API usage guidelines.

Getting your credentials

To obtain your ZMOK API key, follow these steps:

  1. Sign Up/Log In: Navigate to the ZMOK homepage and either sign up for a new account or log in to your existing one. ZMOK offers a free Developer Plan that includes 50,000 requests per month, which is suitable for initial testing and development ZMOK pricing details.
  2. Access Developer Dashboard: Once logged in, access your personal developer dashboard. This is usually where all account-specific settings, usage statistics, and API key management tools are located.
  3. Generate API Key: Within the dashboard, look for a section related to API keys, credentials, or access tokens. You should find an option to generate a new API key. Follow any on-screen prompts to name your key (optional) or confirm its creation.
  4. Store Your Key Securely: After generation, your API key will be displayed. It is crucial to copy this key immediately and store it in a secure location. ZMOK, like many API providers, typically displays the key only once for security reasons and does not store it in a retrievable format. If you lose your key, you may need to generate a new one and revoke the old one.
  5. Review Documentation: For specific instructions and any unique requirements, always refer to the official ZMOK API documentation on key generation and usage.

Authenticated request example

This section provides examples of how to make an authenticated request to the ZMOK API using an API key. The examples use common programming languages supported by ZMOK's SDKs: JavaScript and Python ZMOK SDK information.

JavaScript (Node.js with fetch)

This example demonstrates fetching real-time cryptocurrency price data using the fetch API in Node.js, including the API key in the Authorization header.

const API_KEY = process.env.ZMOK_API_KEY; // Stored securely as an environment variable
const API_ENDPOINT = 'https://api.zmok.io/v1/market/price?symbol=BTCUSDT';

async function getCryptoPrice() {
  try {
    const response = await fetch(API_ENDPOINT, {
      method: 'GET',
      headers: {
        'Authorization': `Bearer ${API_KEY}`,
        'Content-Type': 'application/json'
      }
    });

    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }

    const data = await response.json();
    console.log('Current BTCUSDT price:', data);
  } catch (error) {
    console.error('Error fetching crypto price:', error);
  }
}

getCryptoPrice();

Python (requests library)

This Python example uses the popular requests library to make a similar API call, passing the API key in the HTTP header.

import os
import requests

API_KEY = os.environ.get("ZMOK_API_KEY") # Stored securely as an environment variable
API_ENDPOINT = 'https://api.zmok.io/v1/market/price?symbol=ETHUSDT'

def get_crypto_price():
    if not API_KEY:
        print("Error: ZMOK_API_KEY environment variable not set.")
        return

    headers = {
        'Authorization': f'Bearer {API_KEY}',
        'Content-Type': 'application/json'
    }

    try:
        response = requests.get(API_ENDPOINT, headers=headers)
        response.raise_for_status()  # Raise an exception for HTTP errors (4xx or 5xx)
        data = response.json()
        print('Current ETHUSDT price:', data)
    except requests.exceptions.RequestException as e:
        print(f"Error fetching crypto price: {e}")

if __name__ == "__main__":
    get_crypto_price()

Security best practices

Securing your API keys and interactions with ZMOK APIs is paramount to protect your application and user data. Adhere to these best practices:

  • Environment Variables: Never hardcode API keys directly into your source code. Instead, use environment variables for storing sensitive credentials. This prevents keys from being exposed in version control systems or publicly accessible codebases. For cloud deployments, utilize secret management services provided by your cloud provider (e.g., AWS Secrets Manager or Google Cloud Secret Manager).
  • HTTPS/TLS Only: Always ensure that all communications with ZMOK APIs are conducted over HTTPS (TLS). This encrypts data in transit, protecting your API key and the data you send and receive from eavesdropping and tampering. ZMOK API endpoints are designed to enforce HTTPS ZMOK API reference.
  • Restrict API Key Privileges: If ZMOK offers granular permissions for API keys (check their documentation), create keys with the minimum necessary permissions. This limits the potential damage if a key is compromised.
  • Regular Key Rotation: Periodically rotate your API keys. This practice minimizes the window of opportunity for a compromised key to be exploited. When generating a new key, ensure the old key is properly revoked and removed from your applications.
  • IP Whitelisting (if available): If ZMOK supports IP whitelisting, configure your API keys to only accept requests originating from a specific set of trusted IP addresses. This adds an extra layer of security, preventing unauthorized access even if a key is stolen.
  • Client-Side vs. Server-Side: Avoid exposing API keys in client-side code (e.g., JavaScript in a web browser) where they can be easily inspected. For web applications, all API calls requiring an API key should be routed through your own secure backend server, which then makes the authenticated request to ZMOK.
  • Error Handling and Logging: Implement robust error handling and logging for API requests. Monitor for unusual activity or excessive failed authentication attempts, which could indicate a security incident.
  • Keep Dependencies Updated: Ensure that all libraries, frameworks, and SDKs used in your application are kept up to date. Security vulnerabilities in third-party components can inadvertently expose your API keys or create other security risks.