From 23cd764fb2c061adcce8def0e3974addcce6f8fc Mon Sep 17 00:00:00 2001 From: GiselleNessi Date: Wed, 9 Sep 2026 11:07:07 +0200 Subject: [PATCH 1/2] docs: quote requests with a referrer require an API key Adds the 2026-09-03 changelog entry, the UNAUTHORIZED_QUOTE error code row, and an authentication callout on the API keys page. Covers the enforcement shipped in INT2-1418 (INT2-1384). --- references/api/api-keys.mdx | 4 ++++ references/api/api_core_concepts/handling-errors.mdx | 1 + references/api/changelog.mdx | 4 ++++ 3 files changed, 9 insertions(+) diff --git a/references/api/api-keys.mdx b/references/api/api-keys.mdx index d8e95620..538336dd 100644 --- a/references/api/api-keys.mdx +++ b/references/api/api-keys.mdx @@ -65,6 +65,10 @@ Already hitting a limit? See [Handling Rate Limits](/references/api/api_core_con ## How to Use an API key + +Quote requests that set a `referrer` must be authenticated: pass your API key in the `x-api-key` header on `POST /quote` and `POST /quote/v2`. Requests with a referrer but no valid key return `401` with `errorCode: "UNAUTHORIZED_QUOTE"`. Unauthenticated quote requests are supported only without a `referrer`, at the public rate limit. + + ### HTTP requests Pass the key in the request headers on every request: diff --git a/references/api/api_core_concepts/handling-errors.mdx b/references/api/api_core_concepts/handling-errors.mdx index be11ca61..d62d75fb 100644 --- a/references/api/api_core_concepts/handling-errors.mdx +++ b/references/api/api_core_concepts/handling-errors.mdx @@ -39,6 +39,7 @@ These are known validation and routing issues that developers should gracefully | `SOLANA_TX_TOO_LARGE` | The compiled Solana deposit transaction exceeds Solana's 1232-byte wire limit and cannot be signed or broadcast. The response `message` reports the measured size and how many bytes it lands over. See [Solana Support](/references/api/api_guides/solana#transaction-size-optimization). | | `SWAP_IMPACT_TOO_HIGH` | The swap's price impact exceeds acceptable thresholds. | | `UNAUTHORIZED` | The user is not authenticated or lacks valid authorization. | +| `UNAUTHORIZED_QUOTE` | The quote request includes a `referrer` but no valid `x-api-key` header. | | `UNSUPPORTED_CHAIN` | The specified chain is not supported by the platform. | | `UNSUPPORTED_CURRENCY` | The specified currency is not supported for input or output, or the token pair cannot be priced. | | `UNSUPPORTED_EXECUTION_TYPE` | The execution type used is not supported for fee estimation or execution. | diff --git a/references/api/changelog.mdx b/references/api/changelog.mdx index 5016f6c7..e2512b01 100644 --- a/references/api/changelog.mdx +++ b/references/api/changelog.mdx @@ -13,6 +13,10 @@ description: "Record of breaking changes, deprecations, and notable additions to **Replacement** — use [`POST /quote/v2`](/references/api/get-quote-v2) to request a quote and follow the returned steps to execute it. The Quote API covers bridging, swapping, and calling through a single unified surface, and is the same flow already recommended by the [`POST /price`](/references/api/get-price) and [`POST /execute`](/references/api/execute) references. See [Step Execution](/references/api/api_core_concepts/step-execution) for how to submit each step returned by the quote. +## 2026-09-03 — Quote requests with a `referrer` require an API key + +**Breaking** — `POST /quote` and `POST /quote/v2`: requests that include a `referrer` in the body now require a valid `x-api-key` header. Requests with a referrer but no valid key return `401` with `errorCode: "UNAUTHORIZED_QUOTE"`. Requests that omit `referrer` are unaffected and continue to work unauthenticated at the public rate limit. Note that the Relay SDK sets `referrer` automatically, so SDK integrations must configure **`apiKey`** on `createClient` or pass the key per call via the `headers` parameter. Create and manage API keys in the [Relay Dashboard](https://dashboard.relay.link) — see [API keys and Rate Limits](/references/api/api-keys). + ## 2026-09-01 — Request signature endpoints removed **Breaking** — `GET /requests/:requestId/signature` and `GET /requests/:requestId/signature/v2` have been removed. Calls to both endpoints now return `404`. Both returned a solver signature over a small subset of intent fields, which never covered the minimum output amount, required a second call after the quote, returned only partial data until the request reached a terminal state, and behaved inconsistently across chains. From 51f76aa35d0426c52959ca2c9b72ba286e15b02a Mon Sep 17 00:00:00 2001 From: GiselleNessi Date: Wed, 9 Sep 2026 14:42:44 +0200 Subject: [PATCH 2/2] docs: drop the no-referrer unauthenticated framing per review --- references/api/api-keys.mdx | 2 +- references/api/changelog.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/references/api/api-keys.mdx b/references/api/api-keys.mdx index 538336dd..0c136f44 100644 --- a/references/api/api-keys.mdx +++ b/references/api/api-keys.mdx @@ -66,7 +66,7 @@ Already hitting a limit? See [Handling Rate Limits](/references/api/api_core_con ## How to Use an API key -Quote requests that set a `referrer` must be authenticated: pass your API key in the `x-api-key` header on `POST /quote` and `POST /quote/v2`. Requests with a referrer but no valid key return `401` with `errorCode: "UNAUTHORIZED_QUOTE"`. Unauthenticated quote requests are supported only without a `referrer`, at the public rate limit. +Quote requests that set a `referrer` must be authenticated: pass your API key in the `x-api-key` header on `POST /quote` and `POST /quote/v2`. Requests with a referrer but no valid key return `401` with `errorCode: "UNAUTHORIZED_QUOTE"`. ### HTTP requests diff --git a/references/api/changelog.mdx b/references/api/changelog.mdx index e2512b01..9ef5ea9e 100644 --- a/references/api/changelog.mdx +++ b/references/api/changelog.mdx @@ -15,7 +15,7 @@ description: "Record of breaking changes, deprecations, and notable additions to ## 2026-09-03 — Quote requests with a `referrer` require an API key -**Breaking** — `POST /quote` and `POST /quote/v2`: requests that include a `referrer` in the body now require a valid `x-api-key` header. Requests with a referrer but no valid key return `401` with `errorCode: "UNAUTHORIZED_QUOTE"`. Requests that omit `referrer` are unaffected and continue to work unauthenticated at the public rate limit. Note that the Relay SDK sets `referrer` automatically, so SDK integrations must configure **`apiKey`** on `createClient` or pass the key per call via the `headers` parameter. Create and manage API keys in the [Relay Dashboard](https://dashboard.relay.link) — see [API keys and Rate Limits](/references/api/api-keys). +**Breaking** — `POST /quote` and `POST /quote/v2`: requests that include a `referrer` in the body now require a valid `x-api-key` header. Requests with a referrer but no valid key return `401` with `errorCode: "UNAUTHORIZED_QUOTE"`. Note that the Relay SDK sets `referrer` automatically, so SDK integrations must configure **`apiKey`** on `createClient` or pass the key per call via the `headers` parameter. Create and manage API keys in the [Relay Dashboard](https://dashboard.relay.link) — see [API keys and Rate Limits](/references/api/api-keys). ## 2026-09-01 — Request signature endpoints removed