Guides

Browser keys

Call Pikeway straight from a web page. Restrict a key to your domains and the gateway accepts it only from pages on those sites, so a key copied out of your front end is useless anywhere else.

Set up a browser key

1

Create a dedicated key

In Console → API Keys, create a new key just for your web app. Don't reuse your server key.

2

Add your sites

Open the key's Sites setting and list the hostnames your pages are served from: app.example.com, *.example.com for any subdomain, or localhost for development. Hostnames only, without scheme, port or path; up to 50 entries.

*.example.com matches subdomains but not example.com itself. Add both if your app runs on the bare domain too.

3

Set a spending limit

Give the key a Limit as well. Anyone can drive traffic through your own pages, and the limit caps what that can cost you.

4

Call from the page

javascript

// In your web app. The key is visible to anyone who opens devtools, and that's fine:
// the gateway only accepts it from pages on your sites.
const PIKEWAY_BROWSER_KEY = 'pk-…';

const res = await fetch('https://gw.pikeway.ai/gw/dexscreener/latest/dex/search?q=WBTC', {
  headers: { Authorization: `Bearer ${PIKEWAY_BROWSER_KEY}` },
});
console.log(res.headers.get('X-Pikeway-Cost'), await res.json());

Browsers can't set headers on WebSockets, so pass the key as ?key=; the gateway strips it before forwarding. Cost and call id headers are readable from JavaScript (they're exposed via CORS).

How it's enforced

The gateway reads the request's Origin header (falling back to Referer) and compares its hostname with your list. Browsers set these headers themselves, and page scripts can't change them.
Requests with neither header, which is what servers, scripts and curl send by default, are refused. A browser key is for browsers only.
Refused requests get 403 request origin not allowed for this API key and are never charged.
The same check applies to paid calls through /gw/, /v1/run, the AI gateway and WebSockets.
CORS is open by default, but a provider can restrict its API to its own domains. If a browser blocks the response from one API, that API isn't meant to be called from other sites; call it from your server instead.

bash

# The same key used from a server (no Origin / Referer):
curl "https://gw.pikeway.ai/gw/dexscreener/latest/dex/search?q=WBTC" -H "Authorization: Bearer pk-…"
# 403 {"error":"request origin not allowed for this API key"}

Origin checks stop a copied key from being reused on other sites or servers. They don't stop someone from calling your API through your own pages, so keep the spending limit and only enable what the page needs.

Related key restrictions

IP allowlist

The server-side counterpart: limit a key to your servers' IPs or CIDR ranges. See Keys, balance & billing.

Sign in with Pikeway

Want each user to pay from their own balance instead of yours? Use OAuth; see Integrations.