docs: add October 2 quote/v2 API key requirement callouts

[GiselleNessi]

Adds the authentication callouts for the upcoming quote/v2 API key requirement (enforcement date: October 2, 2026), per INT2-1384.

Changes

• New shared snippet snippets/QuoteV2AuthCallout.mdx (states the date, how to send the key, that quote/v2 remains supported for authenticated requests, and links to the API key instructions)
• Placed once on: Get Quote API reference, API Quickstart (inside the API key provisioning callout), SDK getQuote (below the server-side key warning), and the seven integration guides that show direct quote/v2 requests (bridging, calling, solana, bitcoin, hyperliquid, lighter, builder-codes) — immediately before each page's first quote/v2 example
• references/api/api-keys.mdx: extended the existing referrer-authentication Warning with the October 2 requirement

Reviewer notes

• INT2-1384 names a quote/v2 deprecation copy deck as the wording source of truth; I did not have it, so the snippet text is a standard draft. If the deck's wording differs, it is a single-file swap in the snippet.
• Current live behavior re-verified today: referrer without key returns 401 UNAUTHORIZED_QUOTE, keyless without referrer still returns 200, consistent with the callout's phrasing.

Closes INT2-1384 (docs portion).

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
unevenlabs	🟢 Ready	View Preview	Sep 11, 2026, 2:17 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[github-actions]

Claude finished @GiselleNessi's task in 6m 7s —— View job

---

Code review — docs: add October 2 quote/v2 API key requirement callouts

The snippet-based approach is the right call, and the wording is accurate against current behavior. Eight findings below, ordered by impact. The first two are the ones I'd block on.

---

1. Every quote/v2 example on these pages still omits x-api-key

The callout tells readers to pass the key, but not one of the adjacent examples shows it. On October 2 every one of these paste-and-run blocks starts returning 401:

Page	Example
references/api/quickstart.mdx	152
references/api/api_guides/bitcoin.mdx	117
references/api/api_guides/bridging-integration-guide.mdx	39
references/api/api_guides/builder-codes.mdx	48
references/api/api_guides/calling-integration-guide.mdx	60
references/api/api_guides/hyperliquid-support.mdx	69
references/api/api_guides/lighter-support.mdx	55
references/api/api_guides/solana.mdx	89

There's good prior art in this repo — references/api/api_guides/migrating-to-requests-v3.mdx:313 updates the example itself with x-api-key: <your-api-key> # now required rather than relying on a callout alone. AGENTS.md §2.8 ("Each code block is self-contained — include imports, client construction, and any prerequisite setup") points the same way.

Fix this →

2. No changelog entry for a breaking auth change

AGENTS.md §4.2 makes the changelog the record for breaking changes, and §4.5 gives the entry format. references/api/changelog.mdx already logs the directly analogous change at 2026-09-03 — Quote requests with a referrer require an API key. Without an entry here, the generated changelog.mdx never mentions October 2 — the callouts are the only notice, and only for readers who happen to open one of these pages.

Fix this →

3. getQuote.mdx — the snippet contradicts the Warning directly above it

references/relay-kit/sdk/actions/getQuote.mdx:18-21:

<Warning>
**Warning**: Never pass `x-api-key` in headers from client-side code. …
</Warning>

<QuoteV2AuthCallout />   ← "Pass your key in the `x-api-key` header"

A client-side SDK integrator reads "never send the key from the client" and then "every request will need the key," with no third option offered. The page never mentions createClient({ apiKey }), which is the actual answer and is what the 2026-09-03 changelog entry points integrators to. Consider an SDK-specific variant of the snippet, or a sentence here naming createClient.

4. Coverage gap — six other pages show direct quote/v2 requests

Not covered by this PR: features/deposit-addresses.mdx (79, 473), features/fast-fill.mdx (122), features/gasless-execution.mdx (27), features/price-stabilization.mdx (36, 679), references/api/api_core_concepts/input-validation.mdx (38), references/api/api_core_concepts/refunds.mdx (56). The PR body scopes to "integration guides," so this may be deliberate — but features/gasless-execution.mdx:27 in particular is a bare curl with no key.

5. get-quote-v2.mdx — <Warning> reads as a deprecation marker

Per §4.3, a <Warning> immediately after frontmatter on an API endpoint page is this repo's deprecation signal (get-price, get-currencies, get-config all use exactly that shape). On a live, fully-supported endpoint it invites the wrong read — and the PR body itself calls the source a "deprecation copy deck," which suggests the confusion is already in circulation. §3.3 asks for <Note> or <Info> for cross-cutting notes on these stubs.

6. quickstart.mdx:32 — nested callout, duplicated guidance

The snippet is placed inside the existing <Callout icon="key">, which already says "Create an API key… see API keys and Rate Limits." The result is a Warning inside a Callout, with the same link twice. Also worth noting §3.7: quickstart is explicitly carved out, and upstream-driven changes there should be flagged for human review rather than patched by pattern.

7. Indentation breaks the <Step> flow on two guides

bridging-integration-guide.mdx:35 and calling-integration-guide.mdx:57 insert <QuoteV2AuthCallout /> at column 0 while the surrounding <Step> content sits at 4 spaces. Compare quickstart.mdx:27-33, where the nested <Callout> keeps the step's indentation. Beyond the inconsistency, in both files the callout lands between the intro prose and the <CodeGroup> it introduces, splitting them.

8. handling-errors.mdx:43 will go stale on the same date

UNAUTHORIZED_QUOTE — The quote request includes a referrer but no valid x-api-key header.

That description stops being complete on October 2. Worth updating in the same PR so the error table and the callouts don't disagree.

---

Nits

• snippets/QuoteV2AuthCallout.mdx has no trailing newline after </Warning>.
• Nine of the ten import additions leave a doubled blank line after the import statement; on pages that already have an import block (bridging, calling, quickstart) the new import is separated from the existing ones rather than grouped with them.
• hyperliquid-support.mdx:64-65 places the component directly against the ### Example Quote Request heading with no blank line, unlike the other seven placements.

Verified as correct

• The #how-to-use-an-api-key anchor resolves — references/api/api-keys.mdx:66 is ## How to Use an API key.
• Snippet is well under the §2.5 15-line callout cap, uses root-relative links (§2.6), and follows §5 terminology ("API key", backticked endpoint).
• The api-keys.mdx edit is consistent with the surrounding Warning and doesn't duplicate the snippet import.

---

_{Note: /code-review:code-review errored on invocation; this review ran via the code-review skill plus direct file inspection. No files were changed — review only.}
· branch docs/quote-v2-auth-callouts

[greptile-apps]

Confidence Score: 4/5

Not safe to merge until the Deposit Addresses quote example clearly documents the required API key.

Findings

1.  Add deposit quote warning ▶

Summary

• This update adds the upcoming POST /quote/v2 API-key warning across key API, SDK, and integration documentation. The Deposit Addresses guide still contains a copyable unauthenticated quote request without the new warning or x-api-key header, so the documentation remains incomplete and should not merge until that guide is updated.

_{Reviews (1) · Last reviewed commit: "docs: add October 2 quote/v2 API key req..."}