Gauntlet · Authentication Profile

Gauntlet Authentication

Authentication

The Gauntlet REST API (api.gauntlet.xyz) authenticates every request with a partner-provisioned API key passed as an HTTP Bearer token. The published OpenAPI does not declare securitySchemes, so this profile is captured from the docs Auth & Credentials page; 401 responses are documented across the spec.

Gauntlet secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyCrypto DataDeFiRisk ManagementYieldVaultBlockchainWeb3Financial Modeling
Methods: http Schemes: 1 OAuth flows: API key in: header

Security Schemes

bearerAuth http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://docs.gauntlet.xyz/onboarding/credentials
description: >-
  The Gauntlet REST API (api.gauntlet.xyz) authenticates every request with a
  partner-provisioned API key passed as an HTTP Bearer token. The published
  OpenAPI does not declare securitySchemes, so this profile is captured from the
  docs Auth & Credentials page; 401 responses are documented across the spec.
docs: https://docs.gauntlet.xyz/onboarding/credentials
summary:
  types: [http]
  http_schemes: [bearer]
  api_key_in: [header]
schemes:
  - name: bearerAuth
    type: http
    scheme: bearer
    header: Authorization
    format: "Authorization: Bearer <API_KEY>"
    description: >-
      Partner-provisioned API key. After partner approval Gauntlet provisions an
      API key for your organization. Keys are server-side only — never expose in
      client-side code, public repos, or version control. Docs recommend separate
      keys for development, staging, and production, and rotating production
      credentials every 90 days.
    provisioning: Partner approval, then Gauntlet provisions a key (docs.gauntlet.xyz/onboarding/sign-up)
    test_live_separation: none-documented
    sources: [https://docs.gauntlet.xyz/onboarding/credentials]
notes: >-
  On-chain deposit/withdraw flows via @gauntlet-xyz/sdk are authorized by the user's
  wallet signature (viem), not the API key; the API key authorizes read access to
  vault/position/analytics data.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/gauntlet-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.