'%20d='M0%200H100C119%200%20128%209%20128%2028V39C128%2050%20122%2057%20110%2061C122%2065%20128%2074%20128%2087V100H92V88C92%2077%2088%2073%2077%2073H34V100H0ZM34%2025V49H79C89%2049%2092%2045%2092%2037C92%2029%2089%2025%2079%2025Z'/%3e%3cpath%20transform='translate(144)'%20d='M0%200H38V100H0Z'/%3e%3cpath%20transform='translate(198)'%20d='M0%200H107C130%200%20140%2010%20140%2033V67C140%2090%20130%20100%20107%20100H0ZM35%2027V73H96C103%2073%20106%2070%20106%2063V37C106%2030%20103%2027%2096%2027Z'/%3e%3cpath%20transform='translate(354)'%20d='M0%200H107C130%200%20140%2010%20140%2033V67C140%2090%20130%20100%20107%20100H0ZM35%2027V73H96C103%2073%20106%2070%20106%2063V37C106%2030%20103%2027%2096%2027Z'/%3e%3cpath%20transform='translate(510)'%20d='M0%200H34V73H120V100H0Z'/%3e%3cpath%20transform='translate(646)'%20d='M0%200H128V25H34V38H118V62H34V75H128V100H0Z'/%3e%3c/g%3e%3c/svg%3e)
Available, development access
Authentication
One header, HTTPS only, server side only.
Header formatPermalink to this section
Present the key in an x-api-key header on every request. Keys are not accepted as a query parameter, because query strings end up in proxy logs and browser history.
curl "$RIDDLE_API_BASE/v1/markets/kalshi/$MARKET_ID" \
-H "x-api-key: $RIDDLE_API_KEY"RotationPermalink to this section
- 1.Ask for a second key while the first is still active.
- 2.Deploy the new key to your secret store and let the change roll out.
- 3.Confirm your traffic has moved over to the new key.
- 4.Retire the old key. Retirement takes effect for new requests; in-flight requests complete.
Practices we expectPermalink to this section
- Server side only. Do not ship a key to a browser, a mobile binary or a notebook you share.
- Redact the x-api-key header everywhere you log requests, including error reporters and traces.
- One key per deployment target, so retiring a compromised key does not take down everything else.
- Treat a 401 as terminal, not retryable. Retrying an unauthorised request will not make it authorised.