docs: add October 2 quote/v2 API key requirement callouts - #462

Preview deployment for your docs. Learn more about Mintlify Previews.

💡 Tip: Enable Automations to automatically generate PRs for you.

Claude finished @GiselleNessi's task in 6m 7s —— View job

Code review — docs: add October 2 quote/v2 API key requirement callouts

The snippet-based approach is the right call, and the wording is accurate against current behavior. Eight findings below, ordered by impact. The first two are the ones I'd block on.

1. Every quote/v2 example on these pages still omits x-api-key

The callout tells readers to pass the key, but not one of the adjacent examples shows it. On October 2 every one of these paste-and-run blocks starts returning 401:

There's good prior art in this repo — references/api/api_guides/migrating-to-requests-v3.mdx:313 updates the example itself with x-api-key: <your-api-key> # now required rather than relying on a callout alone. AGENTS.md §2.8 ("Each code block is self-contained — include imports, client construction, and any prerequisite setup") points the same way.

Fix this →

2. No changelog entry for a breaking auth change

AGENTS.md §4.2 makes the changelog the record for breaking changes, and §4.5 gives the entry format. references/api/changelog.mdx already logs the directly analogous change at 2026-09-03 — Quote requests with a referrer require an API key. Without an entry here, the generated changelog.mdx never mentions October 2 — the callouts are the only notice, and only for readers who happen to open one of these pages.

Fix this →

3. getQuote.mdx — the snippet contradicts the Warning directly above it

references/relay-kit/sdk/actions/getQuote.mdx:18-21:

<Warning>
**Warning**: Never pass `x-api-key` in headers from client-side code. …
</Warning>

<QuoteV2AuthCallout />   ← "Pass your key in the `x-api-key` header"

A client-side SDK integrator reads "never send the key from the client" and then "every request will need the key," with no third option offered. The page never mentions createClient({ apiKey }), which is the actual answer and is what the 2026-09-03 changelog entry points integrators to. Consider an SDK-specific variant of the snippet, or a sentence here naming createClient.

4. Coverage gap — six other pages show direct quote/v2 requests

Not covered by this PR: features/deposit-addresses.mdx (79, 473), features/fast-fill.mdx (122), features/gasless-execution.mdx (27), features/price-stabilization.mdx (36, 679), references/api/api_core_concepts/input-validation.mdx (38), references/api/api_core_concepts/refunds.mdx (56). The PR body scopes to "integration guides," so this may be deliberate — but features/gasless-execution.mdx:27 in particular is a bare curl with no key.

5. get-quote-v2.mdx — <Warning> reads as a deprecation marker

Per §4.3, a <Warning> immediately after frontmatter on an API endpoint page is this repo's deprecation signal (get-price, get-currencies, get-config all use exactly that shape). On a live, fully-supported endpoint it invites the wrong read — and the PR body itself calls the source a "deprecation copy deck," which suggests the confusion is already in circulation. §3.3 asks for <Note> or <Info> for cross-cutting notes on these stubs.

6. quickstart.mdx:32 — nested callout, duplicated guidance

The snippet is placed inside the existing <Callout icon="key">, which already says "Create an API key… see API keys and Rate Limits." The result is a Warning inside a Callout, with the same link twice. Also worth noting §3.7: quickstart is explicitly carved out, and upstream-driven changes there should be flagged for human review rather than patched by pattern.

7. Indentation breaks the <Step> flow on two guides

bridging-integration-guide.mdx:35 and calling-integration-guide.mdx:57 insert <QuoteV2AuthCallout /> at column 0 while the surrounding <Step> content sits at 4 spaces. Compare quickstart.mdx:27-33, where the nested <Callout> keeps the step's indentation. Beyond the inconsistency, in both files the callout lands between the intro prose and the <CodeGroup> it introduces, splitting them.

8. handling-errors.mdx:43 will go stale on the same date

UNAUTHORIZED_QUOTE — The quote request includes a referrer but no valid x-api-key header.

That description stops being complete on October 2. Worth updating in the same PR so the error table and the callouts don't disagree.

Nits

• snippets/QuoteV2AuthCallout.mdx has no trailing newline after </Warning>.
• Nine of the ten import additions leave a doubled blank line after the import statement; on pages that already have an import block (bridging, calling, quickstart) the new import is separated from the existing ones rather than grouped with them.
• hyperliquid-support.mdx:64-65 places the component directly against the ### Example Quote Request heading with no blank line, unlike the other seven placements.

Verified as correct

• The #how-to-use-an-api-key anchor resolves — references/api/api-keys.mdx:66 is ## How to Use an API key.
• Snippet is well under the §2.5 15-line callout cap, uses root-relative links (§2.6), and follows §5 terminology ("API key", backticked endpoint).
• The api-keys.mdx edit is consistent with the surrounding Warning and doesn't duplicate the snippet import.

_{Note: /code-review:code-review errored on invocation; this review ran via the code-review skill plus direct file inspection. No files were changed — review only.}
· branch docs/quote-v2-auth-callouts

Confidence Score: 4/5

Not safe to merge until the Deposit Addresses quote example clearly documents the required API key.

Findings

1.  Add deposit quote warning ▶

_{Reviews (1) · Last reviewed commit: "docs: add October 2 quote/v2 API key req..."}