Build on ApeCover

Start here

Keys are issued from your account page: sign in, register your integration, and the key is shown once. Go to your account — then the two calls below are enough to confirm everything is wired up.

# 1. Get a key at volumex.insure/app, then check it works
curl -H "Authorization: Bearer $APECOVER_KEY" \
     https://volumex.insure/api/v1/whoami

# 2. Price a policy before you commit to anything
curl -X POST https://volumex.insure/api/quote \
     -H 'content-type: application/json' \
     -d '{"pool":"$POOL","tradeSize":"300000000","tier":1,"packSize":10}'

A key authenticates as soon as it is issued, before your application is reviewed, so you can build against the API while you wait. What it cannot do until an operator registers you on chain is earn — see what approval does and does not mean.

The SDK

@apecover/sdk collapses buy-a-policy-if-needed and register-the-trade into one call. It reuses a prepaid pack while it has credits and buys a new one when it runs out, so your code never handles a policy.

npm install @apecover/sdk

import { ApeCover } from '@apecover/sdk';
import { Connection, Keypair } from '@solana/web3.js';

const ape = new ApeCover({
  apiKey: process.env.APECOVER_API_KEY,   // issued at /app, shown once
  connection: new Connection(process.env.RPC_URL, 'confirmed'),
  signer: Keypair.fromSecretKey(secret),  // never transmitted
});

// After your swap confirms, before you reply to the user.
const result = await ape.insureTrade({
  swapSignature,          // base58, exactly as your swap returned it
  tokenMint,
  tradeSize: 300_000_000n, // lamports, omit to insure it all
  tier: 'standard',
});

if (result.status === 'insured') console.log('covered', result.trade);
else if (result.status === 'declined') console.log('no cover:', result.reason);
else console.log('sent, outcome pending', result.signature);

The API key authenticates to ApeCover, never to Solana. It cannot move lamports and is not a wallet — your keypair signs, locally, and the SDK never transmits it. What the key buys is the attestation: registering a trade needs the pool attestor to co-sign, because entry price and market cap are not computable on chain and a self-reported entry price is the fraud that co-signature exists to prevent. The client refuses to construct in a browser, where a key would be readable by every visitor.

Amounts are bigint throughout. A JavaScript number silently rounds past 2⁵³, and sizing is the one thing a bot must not get wrong.

Approved is not the same as earning

Two things have to be true before a revenue share accrues, and it is worth knowing which is which, because the first happens in seconds and the second involves a human.

1. Your application is accepted. Your key already worked before this; acceptance is a decision, not a capability.
2. An operator runs register_partner. That instruction is admin-signed, so it cannot be self-served. Until the transaction lands there is no Partner account for policy.partner to point at, and nothing accrues.

/v1/whoami answers both questions in one field: earning is true only when the on-chain account exists. Your account page reads “Approved — not yet on chain” for the state in between rather than rounding it up.

Webhooks

We POST trade.insured, claim.paid and claim.rejected to your endpoint, signed with your API secret. Verify the signature and the replay guard: a signature proves a delivery came from us, not that it is new, and a replayed claim.paid is worth money to anyone whose handler credits an account on receipt.

import { verifyWebhook, InMemoryNonceStore } from '@degen-insurance/api';

const nonces = new InMemoryNonceStore(); // back this with Redis in production

const result = verifyWebhook(
  rawBody,                                   // raw bytes, not a re-serialised object
  request.headers['x-degen-signature'],
  YOUR_API_SECRET,
  { nonces, nowTs: Math.floor(Date.now() / 1000) },
);

if (!result.ok) return reply.code(400).send(result.reason);

Endpoint reference

10 endpoints, generated from the service’s own route table. The machine-readable version is at https://volumex.insure/api/openapi.json. A field marked ? is optional.

What this API is not

Every read here comes from the indexed projection of the event log, not from the chain directly, so it can be a few seconds behind — which is why every response carries asOfSlot rather than leaving you to assume it is current. It is the right source for a dashboard and the wrong one for a decision that moves money. The keeper re-reads the chain before finalising anything, and so should you.

/quote is the exception: it reads pool parameters from chain, because a quote is a number the caller is about to act on.