Six chains, one API.

Try it right now

The base URL is https://foxd.xyz/api/v1, and every endpoint takes a key. Getting one is not a barrier — see below; an agent can sign itself up and be calling this within one round trip.

curl 'https://foxd.xyz/api/v1/tokens/trending?chain=base&limit=10' \
  -H "Authorization: Bearer $FOXD_API_KEY"

Plain HTTP, so anything that can make a request works — these five are shown because they cover most people, not because they are special. Go and Rust are a net/http and a reqwest call against the exact same URL.

The four things people actually do

Check a token is not a trap

Two different sources, deliberately. analytics.security is the provider verdict; simulateHoneypot actually simulates a buy and a sell against chain state and is the only one that covers HyperEVM. simulated: false is not a pass — it means no conclusion was reached.

curl 'https://foxd.xyz/api/v1/tokens/bsc/0xbb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c/security' \
  -H "Authorization: Bearer $FOXD_API_KEY"

curl 'https://foxd.xyz/api/v1/tokens/bsc/0xbb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c/simulate' \
  -H "Authorization: Bearer $FOXD_API_KEY"

Quote, then trade

The quote names the venue, expected output and price impact, and it is the same figure the spend cap is checked against. Amounts are base-unit strings — "10000000000000000" is 0.01 ETH.

curl -X POST 'https://foxd.xyz/api/v1/trade/quote' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"chain":"base","tokenIn":"0x0000000000000000000000000000000000000000","tokenOut":"0x532f27101965dd16442e59d40670faf5ebb142e4","amountIn":"10000000000000000","side":"buy"}'

curl -X POST 'https://foxd.xyz/api/v1/trade/execute' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"chain":"base","tokenIn":"0x0000000000000000000000000000000000000000","tokenOut":"0x532f27101965dd16442e59d40670faf5ebb142e4","amountIn":"10000000000000000","side":"buy","slippageBps":100}'

Watch a wallet before copying it

curl 'https://foxd.xyz/api/v1/copy/trader/0xae2fc483527b8ef99eb5d9b44875f005ba1fae13/backtest?windowDays=30&ticketUsd=100' \
  -H "Authorization: Bearer $FOXD_API_KEY"

Be told instead of polling

A webhook costs one call to register and then nothing. Polling a feed every few seconds burns quota to learn nothing most of the time.

curl -X POST 'https://foxd.xyz/api/v1/webhooks' \
  -H "Authorization: Bearer $FOXD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"url":"https://your-service.example/foxd","event":"new_token","filters":{"chain":"base","platform":"pumpfun"}}'

Twenty worked examples, including signing up and launching a token, are in the cookbook.

The API describes itself

All three of these are generated from the same declaration the endpoints are built from, on every request — so they cannot drift from what the server actually does.

• /api/v1 — every endpoint with its route, scopes and cost, as JSON.
• /api/v1/openapi.json — OpenAPI 3.1. Point any generator at it.
• /llms-full.txt — the same surface as plain text, for agents and crawlers.

Getting a key — including headlessly

Create one in Profile → Settings, or let an agent sign itself up with nothing but a keypair:

# 1. ask for a challenge
curl -X POST https://foxd.xyz/api/v1/auth/challenge \
  -H 'content-type: application/json' \
  -d '{"address":"0xYourAddress"}'

# 2. sign the returned message EXACTLY as given, then:
curl -X POST https://foxd.xyz/api/v1/auth/wallet \
  -H 'content-type: application/json' \
  -d '{"message":"<the exact message>","signature":"0x…","address":"0xYourAddress"}'

# → { "apiKey": "fxk_live_…", "wallets": [ … ] }

That one exchange creates the account, provisions an EVM and a Solana wallet, and returns a key — no browser, no human. Sign in with an existing Google, X, Telegram or email account from a headless client via the device flow instead (/api/v1/auth/device), which is the same pattern gh auth login uses.

Those 5 sign-in endpoints are the only ones that answer without a credential, and they sit on their own hard per-IP limit. Everything else is attributable to an account on purpose: an anonymous call cannot be measured, throttled fairly, or cut off if it turns abusive.

What is exposed

Everything the web terminal can do, grouped into 13 modules:

The per-endpoint reference, with every request and response field, is in the documentation.

Four things that will bite you otherwise

• Price changes are ratios, not percents. 0.05 means +5%.
• Amounts are base-unit strings. 0.01 ETH is "10000000000000000" — an 18-decimal integer does not survive a JavaScript float, so numbers are refused where precision matters.
• 503 means retry, 500 means stop. A backing service being briefly unavailable returns 503 with a Retry-After header; a 500 is a real fault and retrying it will not help.
• simulated: false is not a safety pass. It means no conclusion was reached — treat it as unknown, not as safe.

Every failure is structured

{
  "error": {
    "code": "spend_cap_exceeded",
    "message": "this trade ($185.48) would exceed the key's 24h spend cap ($0.00 of $100.00 used)"
  }
}

code is stable and safe to branch on; message is written for a human — or for a model deciding what to do next. Validation failures additionally name the offending fields, so a wrong argument tells you which one and what it wanted.