Get API Access

xPath uses API keys to authenticate requests for quotes, route building, token discovery, gasless execution, and transaction status.

Request Access

Complete the xPath API access form with information about your project and expected integration.

Once access is approved, you will receive an API key for the xPath API.

Base URL

Use the production API base URL:

https://api.xpath.rath.fi

All endpoint paths are relative to this URL. For example:

GET https://api.xpath.rath.fi/supported-chains
GET https://api.xpath.rath.fi/quote
POST https://api.xpath.rath.fi/build-path-by-id

Authentication

Include your API key in the api-key request header:

curl --request GET \
  --url 'https://api.xpath.rath.fi/supported-chains' \
  --header 'api-key: YOUR_API_KEY'

Missing or invalid API keys return 401 Unauthorized.

First Quote Request

After receiving access, test your key with a quote request:

curl --request GET \
  --url 'https://api.xpath.rath.fi/quote?fromChain=8453&toChain=42161&fromToken=0x4200000000000000000000000000000000000006&toToken=0xaf88d065e77c8cC2239327C5EDb3A432268e5831&amount=1000000000000000&sender=0x1111111111111111111111111111111111111111&routeMode=suggested' \
  --header 'api-key: YOUR_API_KEY'

A successful xPath response uses this envelope:

{
  "code": 0,
  "message": "success",
  "data": []
}

Check both the HTTP status and the response code.

Using the Key in an Application

Keep the key in an environment variable:

XPATH_API_KEY=YOUR_API_KEY

Then attach it to requests from your backend:

const response = await fetch('https://api.xpath.rath.fi/supported-chains', {
  headers: {
    'api-key': process.env.XPATH_API_KEY!,
  },
})

if (!response.ok) {
  throw new Error(`xPath request failed: ${response.status} ${await response.text()}`)
}

const result = await response.json()

if (result.code !== 0) {
  throw new Error(`xPath error: ${result.message}`)
}

Security Recommendation

For production applications, route xPath requests through your backend or a protected API proxy.

Do not embed the API key in:

• browser JavaScript bundles
• public mobile application configuration
• public repositories
• logs, analytics events, or error messages

Exposing the key can allow unauthorized use of your account and exhaust its request limits. If a key is exposed, rotate it before continuing to use the integration.

Tokens and Amounts

Before requesting a quote:

1. Fetch supported networks from GET /supported-chains.
2. Fetch tokens from GET /tokens or GET /search-token.
3. Use the token address exactly as returned for that chain.
4. Convert the display amount into a base-10 integer string using the token's decimals.

For example, one token with 6 decimals is:

1000000

Do not assume a native-token placeholder or token decimals. Retrieve current token metadata from xPath.

Access Troubleshooting

For endpoint parameters and response schemas, see the API Reference. To start integrating, continue to the Quickstart.