NoxHash API Guide — Automate Your Mining Operations

Why a Mining API Matters

Once you run more than one or two miners, the web dashboard stops being the fastest way to see everything. You want a single pane of glass that pulls your NoxHash hashrate next to your exchange balances, your pool stats from other operators, and your own BTC price alerts. An API makes that possible without any copy-paste or screen scraping.

The NoxHash API is being designed around three use cases we hear repeatedly from operators: monitoring, portfolio tracking, and custom integrations. The endpoint names and payloads below describe the shape we expect to ship; treat them as a technical preview rather than a frozen contract.

Authentication — How API Keys Will Work

Every protected request will need an API key sent in the Authorization HTTP header as a bearer token. This is the standard pattern followed by most modern REST APIs and keeps the key out of URLs, referer logs, and browser history.

Example request (curl pseudo-code)

The snippet below shows the expected shape. Replace nxh_live_... with the key you copied from your Profile page.

curl -X GET "https://noxhash.com/api/v1/miners" \
  -H "Authorization: Bearer nxh_live_YOUR_KEY_HERE" \
  -H "Accept: application/json"

A successful response returns JSON with a data array and pagination metadata. Unauthorized requests return HTTP 401; requests without a valid scope return 403.

Planned Endpoint Reference

The table below lists the endpoints we expect to expose in the first public release. Names and fields may shift slightly before launch, so check the live documentation when you start coding. All endpoints are read-only to start; write operations (starting miners, creating withdrawal requests) will follow once the read API is stable.

Every list endpoint will return paginated results using the common ?page=1&per_page=25 query pattern, with a meta object containing total, page, and per_page. Defaults cap around 25 items per page to keep response times fast.

Rate Limits and Webhooks

Polling an API every second is wasteful when the data you care about changes every few minutes. The NoxHash API will combine sensible rate limits with a webhook system so you can choose the right tool for each job.

Rate limits

Expect a per-key limit measured in requests per minute. Every response will include headers such as X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. When you hit the ceiling, requests return HTTP 429 with a Retry-After header — back off and retry rather than hammering the endpoint.

Webhooks for events

For anything time-sensitive — a miner going offline, a deposit confirming, a rental expiring — webhooks are strictly better than polling. You register a URL, the NoxHash backend POSTs a signed JSON payload when the event fires, and your server reacts in real time. Typical events we plan to ship:

• miner.status_changed — a machine transitions between Running, Stopped, or Expired.
• deposit.confirmed — an incoming USDT deposit is credited to your wallet.
• withdrawal.processed — a BTC withdrawal completes on-chain.
• rental.expiring_soon — fires roughly 7 days before a rental ends so you can renew proactively.

Payloads will be signed with an HMAC secret so your server can verify authenticity before acting. Follow the guidance in the OWASP API Security Top 10 when designing your webhook handler — especially around input validation, authentication, and replay protection.

Four Automation Patterns Worth Building

Below are the most common workflows operators build once they have API access. None of them is exotic — but each saves real time compared with checking the web dashboard by hand.

Keep Your API Key Safe

An API key is equivalent to your password for the endpoints it can access — treat it accordingly. The habits below are quick to set up and make a leaked key far less damaging:

1. Never commit keys to git. Put them in a .env file that is gitignored, or use a secrets manager like 1Password, Doppler, or AWS Secrets Manager.
2. Call the API from a server, not the browser. Client-side JavaScript ships your key to anyone who opens DevTools. Proxy requests through your own backend instead.
3. Set an expiry on each key. A key with a 90-day expiry limits the blast radius if it leaks. Rotate on a schedule that fits your risk tolerance.
4. Revoke keys you no longer use. Delete old scripts and demo keys from Profile → API Keys the moment they are obsolete.
5. Monitor for unusual activity. If you see requests you did not make, revoke the key immediately and investigate where it may have leaked.

Frequently Asked Questions