x-api-key header at all, so you can make your first call right now. GET /health is always
public regardless of tier.
Calling from a browser
CORS is enabled on every endpoint, so a wallet widget, dapp frontend, or any other browser-side integration can call the API directly, with no server-side proxy required.x-request-id and ravn-version are exposed via Access-Control-Expose-Headers, so your
client-side code can read them. Quote x-request-id if you ever report a bad quote to us; it
is how we find your exact request.
Because your key travels to the browser in that setup, treat a client-side key as public. It
only ever raises a rate limit and carries no spending authority (RAVN never takes custody, and
every swap is still signed by the user’s own wallet), but rotate it like any other public
credential, or keep it server-side and proxy if you would rather not expose it at all.
To use a self-serve or enterprise key, pass it in the
x-api-key header:
401 UNAUTHORIZED. Exceeding your tier’s limit
returns 429 RATE_LIMITED, with a retryAfterSec value in details.
RAVN charges 0 bps by default, on every route, for every tier, self-serve or enterprise.
Full route table, quote fee object, and how this differs from optional x402 call fees: see
Pricing.

