First verification in under 3 minutes.

Create a project

Open the Console, create a workspace and project, then open that project. Policies and API keys are isolated to the project boundary.

Create a policy

For the fastest test choose Wallet allowlist, add one wallet, and give the policy an entitlement such as premium.

For ERC-20 rules, Minimum balance uses raw smallest-unit values from balanceOf. For example, a 6-decimal token such as USDC uses 1000000 to represent 1 whole token. ERC-721 and ERC-1155 minimums are integer token balances.

Issue a test API key

Create a Test key. The plaintext gk_test_... value is shown once. Store it in a server-side environment variable; never ship it in browser code.

Call /api/v1/verify

curl -X POST https://gatekit-ruddy.vercel.app/api/v1/verify \
  -H "Authorization: Bearer gk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "policyId": "pol_YOUR_POLICY_ID",
    "wallet": "0x0000000000000000000000000000000000000001"
  }'

The API key can only verify policies that belong to its own project.

Handle allowed, denied, and error separately

Allowed

{
  "status": "allowed",
  "allowed": true,
  "entitlements": ["premium"]
}

Denied

{
  "status": "denied",
  "allowed": false,
  "entitlements": []
}

Verification unavailable

{
  "status": "error",
  "allowed": false,
  "entitlements": [],
  "rules": [
    {
      "outcome": "error",
      "reason": "verification_error"
    }
  ]
}

A denied result is a normal policy decision and returns HTTP 200. Infrastructure or invalid-contract verification failures return HTTP 503 with status: "error", so applications can fail closed without confusing an outage with a conclusive denial.

Private beta limits

Test: 60 requests/minute and 1,000/day. Live: 300 requests/minute and 25,000/day.

HTTP/1.1 429 Too Many Requests
Retry-After: 21
X-GateKit-RateLimit-Limit: 60
X-GateKit-RateLimit-Remaining: 0
X-GateKit-DailyLimit-Limit: 1000

{
  "error": "rate_limit_exceeded",
  "retryAfterSeconds": 21
}

On HTTP 429, wait for Retry-After. GateKit also returns remaining minute and daily quota headers on authenticated requests.