Authentication

All API requests require a valid API key passed in the Authorization header. Keys are scoped to a tenant and can have granular permissions.

API key format

Keys use the prefix project_silo_live_ or project_silo_test_ followed by a cryptographically random string. Example:

api-key.txttxt

project_silo_live_a1b2c3d4e5f6g7h8i9j0...

Important: The full key is shown exactly once when created. Project Silo stores only a scrypt hash of the key. If you lose it, you must rotate to a new key.

Using the key

curlbash

curl https://api.projectsilo.app/v1/status \
  -H "Authorization: Bearer project_silo_live_..."

The SDK handles this automatically when you pass apiKey to the constructor.

Scopes

Each API key has a set of granted scopes. Requests outside the key's scopes receive a 403 response.

Scope	Grants access to
deposit_accounts:read	GET /v1/deposit-accounts
deposit_accounts:write	POST/PATCH /v1/deposit-accounts
deposits:read	GET /v1/deposits
destination_policy:read	GET /v1/destination-policy
destination_policy:write	PUT /v1/destination-policy
webhooks:read	GET /v1/webhook-endpoints, GET /v1/webhook-deliveries
webhooks:write	POST/PATCH/DELETE /v1/webhook-endpoints
usage:read	GET /v1/usage, GET /v1/fee-preview

Test vs Live keys

Test keys

Prefix project_silo_test_. Safe for development — interactions hit the same settlement service but with sandbox tenants. No real funds move.

Live keys

Prefix project_silo_live_. Production keys — all deposits and settlements are real. Never expose in client-side code or public repositories.

Rate limits

Each API key has configurable rate limits (default: 60 requests/minute). When exceeded, the API returns 429 Too Many Requests with a Retry-After header. The SDK automatically retries on 429 with exponential backoff.