Public discovery
Use the versioned API directory, OpenAPI 3.1 contract, or Ondex MCP server without credentials. Clients should honor RateLimit headers and Retry-After rather than rotating identities or bypassing quotas.
Authentication
Ondex API authentication and wallet authorization
Ondex separates public documentation discovery from user-controlled wallet authorization and protected internal services. Public discovery never needs an API key, while signing always requires explicit approval on the user's device.
Updated 2026-09-02
Authentication matrix
- Public API and OpenAPI
- No API key. Read-only, versioned, and rate-limited.
- Ondex MCP server
- No API key. Read-only documentation discovery over Streamable HTTP.
- WalletConnect
- The dApp uses its own Reown project ID; the user approves connections and requests in Ondex.
- ondex_signIn
- Signed, expiring challenge. The dApp verifies the signature, public key, address, domain, nonce, and expiry.
- One-shot payload
- Generated links contain an opaque status token. Keep it out of logs and verify final ledger state.
- Admin and internal APIs
- Not public developer surfaces. Credentials are intentionally not documented or exposed.
Secret boundary
Never send an XRPL seed phrase, private key, PIN, backup password, signed blob, or internal API key to a public Ondex website endpoint. Redirects and approvals are not settlement evidence; verify ledger results.
Authentication Markdown