This page explains authentication by API family across the IXO Protocol and IXO service APIs. Use it to understand who decides what credentials an API takes before you integrate with it. For the literals (headers, token sources and behaviour per environment), use the Authentication matrix.
Scope
- This page summarizes authentication methods by API family.
- It does not define one flow for all IXO APIs.
- Protocol APIs and service APIs can require different credentials.
Request patterns
The header formats used across the IXO docs are collected in the Authentication matrix.
Warning
Do not assume any one header or token type applies to every endpoint. Confirm each interface against the Authentication matrix.
API families and who sets the rules
| Family | APIs | Authentication |
|---|---|---|
| Protocol gateways | Blockchain RPC API, Blockchain REST API | Chain and node access patterns vary by network and deployment. |
| Service APIs | IXO Blocksync GraphQL API, Matrix state bot API, Registry API | Service operators can enforce different credentials and scopes. |
Security baseline
- Use HTTPS for all authenticated requests.
- Keep credentials in secure runtime storage, not source files.
- Rotate tokens and keys according to your operator policy.
- Log request identifiers and authentication failures for incident triage.