Skip to main content

​
API Key Authentication

All API requests require an API key passed in the X-API-Key header.

​
Getting an API key

  1. Sign up at tronrental.com
  2. Go to Dashboard → API Keys
  3. Click Create API Key
  4. Copy and securely store your key — it’s shown only once

​
IP Whitelist (optional)

You can restrict your API key to specific IP addresses for additional security. Configure this in the dashboard when creating or editing a key.

​
Key permissions

Each API key carries scopes — the operations it is allowed to perform. You choose them in the dashboard when you create or edit a key. A new key gets every read and write scope (buying energy and bandwidth, Smart Mode, reading the balance and history, and more) except withdraw: that scope is enabled separately and requires 2FA and an IP whitelist. A request outside the key’s scopes is refused with HTTP 403. The full list: List API Key Scopes.
Keep your API key secret. Do not expose it in client-side code, public repositories, or URLs.

​
Node API keys

Node API — access to TRON full nodes at node.tronrental.com — has keys of its own. You create them as endpoints in Dashboard → Node API. A Node API key works only at the node: this API answers it with 403 NODE_API_KEY_ONLY. The API keys described on this page do not work at the node either. See Node API → Endpoints and keys.

​
Key usage & request log

Every request authenticated with an API key is recorded for 7 days: method, path, status code, latency and client IP. Query strings are not stored in this view. Open Dashboard → API Keys and expand a key to see its recent requests; the Last Used column shows the most recent call (the auth-time mark is updated at most once per 5 minutes, the request log is exact). The log is available from the dashboard only — an API key cannot read its own log.

​
Rate Limits

API keys are rate-limited per account, not per key: every key of one account shares a single budget. See Rate Limits for details.

​
Errors

Authentication errors return HTTP 401:
If your key is disabled or blocked, you’ll receive HTTP 403.