Authentication

All API requests require authentication with your secret key, included in the Authorization header. Requests must also include a service-identifying header. Missing either will result in a 401 or 400 response.

Base URL

https://api.hyperrails.io/api/v1 There is a single base URL for both test and live mode — the key prefix (sk_test_ vs sk_live_) determines which environment your request runs against, not the URL.

API Key Management

HyperRails issues three distinct credential types from Dashboard → Credentials → API Keys. Each has a separate value for test and live mode.

Credential	Prefix / Format	Used for	Where to send it
Public Key	`pk_test_…` / `pk_live_…`	Identifying your integration in client-side or read-only contexts (e.g. widget embeds, rate display). Safe to expose in frontend code.	Not sent as a header — used only where explicitly documented (e.g. client-side widgets).
Secret Key	`sk_test_…` / `sk_live_…`	All server-to-server API calls. Grants full account access. Never expose client-side.	`Authorization: Bearer sk_live_...` header
Encryption Key	`enc_test_…` / `enc_live_…`	Encrypting sensitive fields (e.g. bank account numbers, blockchain destination addresses) before sending them in request bodies that require field-level encryption. See Field Encryption.	Used locally in your integration to encrypt payload fields — never transmitted as a header.

Required Headers

Every request must include:

{
  "Authorization": "Bearer sk_test_6988f8d1539a48ab945764ec361fa3eb",
  "Content-Type": "application/json",
  "x-service-source": "YourAppName"
}

Header	Required	Description
`Authorization`	Yes	`Bearer <secret_key>`.
`Content-Type`	Yes	Must be `application/json` (except file-upload endpoints, which use `multipart/form-data`).
`x-service-source`	Yes	A free-text identifier for the calling service/application. Requests without this header are rejected with `400 Bad Request`.

Authentication Process

HTTPS is mandatory. Requests over plain HTTP are rejected.
Test vs. live mode is determined entirely by which secret key prefix you use — sk_test_ keys only affect test-mode data, sk_live_ keys only affect live data.
Authentication failure returns 401 Unauthorized.
Missing x-service-source returns 400 Bad Request.

Rotating Keys

You can regenerate any key from Dashboard → Credentials → API Keys → Generate new key. Regenerating a key immediately invalidates the previous one — update all integrations before rotating in production. By following these guidelines, you can ensure secure and authorized access while integrating with HyperRails’s APIs.

API Reference

ISO20022 Compliance

Wallets and Balances

Rates

Exchange

Payout

Dynamic Accounts

Marketplace

Authentication

Authentication

Base URL

API Key Management

Required Headers

Authentication Process

Rotating Keys

​Authentication

​Base URL

​API Key Management

​Required Headers

​Authentication Process

​Rotating Keys

Authentication

Base URL

API Key Management

Required Headers

Authentication Process

Rotating Keys