Pyth API key change risks blocking 316 DeFi integrations

Pyth Network required API keys for direct callers to its Hermes price-delivery endpoint after a cutover on Aug. 26. The network redirected hermes.pyth.network to an upgraded backend that enforces authentication and published an alternate endpoint at https://pyth.dourolabs.app/hermes.

The requirement applies to developers that call Hermes directly; protocols that already integrate Pyth do not need immediate action. Requests can include the key as a bearer token or as an SDK access token. Pyth documented that the routes and response shapes did not change with the upgrade.

Incomplete or partial migrations can prevent applications from completing authenticated Hermes requests or from verifying price updates on-chain. The upgraded Hermes endpoint serves payloads intended for a newer Pyth Core contract. Changing only the endpoint or only the contract-generation code can leave an application unable to verify incoming price data.

In a pull-oracle design, off-chain services deliver signed price payloads that on-chain contracts must accept and verify. An authentication failure or a mismatch between endpoint, SDK and on-chain package can stop a price-update transaction from completing until configurations are corrected.

Sui integrations faced additional steps because the Sui runtime references Pyth’s on-chain package by object ID, which the Pyth DAO cannot replace automatically. Developers working on Sui were instructed to point SuiPriceServiceConnection at the upgraded Hermes endpoint with an access token and to update the oracle dependency in Move.toml to the new package revision. Pyth’s guidance also noted that clients whose constructors cannot accept an accessToken must be replaced or rebuilt to support the new authentication flow.

A live mapping referenced by Pyth links the oracle to 316 protocols and roughly $2.7 billion in tracked value; that figure is dynamic and can count the same exposure more than once because it aggregates borrowed values and similar positions. After the Aug. 26 cutover, checks found no confirmed outages, stale-price events or reported losses, and no universal confirmation that every redirect and migration had completed cleanly.

The immediate test for developers is whether direct callers can authenticate and whether endpoint, SDK and on-chain contract generation settings match. If those elements do not align, price-update transactions may fail until teams update their integrations.