Tiers & Limits

One paid tier: api at $175 USDC/month. The legacy strings basic, pro, and professional from older JWTs and the on-chain subscription contract are accepted as backward-compatible aliases — they resolve identically to api.

Unauthenticated connections can subscribe to public venues at a 3-symbol cap. Authenticating with an API key unlocks the 100-symbol session cap and full historical access.

---

Capabilities

Capability	api
WebSocket connect	✓
quote, print, funding, depth, liquidity	✓
rate_market, rate_depth	✓
ammbook, ammliquidity, spread	✓
Alerts (create / receive alert_fired)	✓
Per-session WS symbol cap	100
Historical REST lookback	Full retention (~90 days today; expanding to inception)
API key issuance	✓ (up to 3 keys)

---

Per-session symbol cap

Each WebSocket session allows up to 100 active subscriptions. Multiple sessions are uncapped — open as many sockets as needed, each with their own 100-symbol budget.

Exceeding 100 on a single session returns:

{ "type": "error", "code": "symbol_limit_reached", "message": "Session symbol cap (100) reached." }

---

Historical lookback

Historical REST endpoints (/v1/history/*) are open to anonymous callers, but the lookback window is authentication-gated:

	Lookback
Unauthenticated	1 day
api	Full DB retention (no hard cap; ~90 days today, expanding to inception)

Authentication uses Authorization: Bearer <JWT>. See Authentication for how to obtain a JWT or API key.

Note

REST endpoints currently require a JWT bearer token; API keys are WebSocket-only. For Python clients that need both REST and WebSocket, obtain a JWT via the password or wallet flow for REST calls and use the API key for WebSocket.

Querying beyond your lookback window returns HTTP 403:

{
  "error": "lookback_too_far_for_tier",
  "message": "Authenticate with an API key for full historical access.",
  "freeLookbackMs": 86400000
}

---

How tier is determined

In priority order (highest wins):

1. Admin override — operator grants api to specific accounts.
2. On-chain subscription — read from the subscription contract at sign-in. Any tier the contract emits (including legacy basic / pro / professional) maps to api.
3. Default — unauthenticated.

GET /api/subscription/status reports the current effective tier. POST /api/subscription/refresh-token mints a fresh JWT with updated claims immediately after an on-chain purchase.

---

API keys

Subscribers can issue up to 3 long-lived API keys for programmatic WebSocket access without a browser session — suitable for Python scripts, data pipelines, and server-side consumers.

• Issue a key: POST /api/apikeys (requires JWT with tier api)
• List keys: GET /api/apikeys
• Revoke a key: DELETE /api/apikeys/{id}

The plaintext key is returned once at issuance; the server stores only its SHA-256 hash. Save it to a secrets manager immediately.

See Authentication — API Key for the full flow.

---

Role-based gating

A small number of surfaces are gated by role rather than tier:

• arbflag WebSocket subscription — requires super_admin
• Trading, LP, risk, and admin endpoints — requires super_admin or firm_admin

Role assignment is operator-managed. A super_admin user bypasses tier checks entirely.