Pump Fun API in 2026: The Official SDKs, the Undocumented Endpoints, and Why There Is No API Key

The pump fun API that most developers go looking for does not exist. There is no api.pump.fun signup page, no dashboard that issues you a key, no rate-limit tier you can upgrade. What pump.fun actually publishes is a pair of MIT-licensed TypeScript SDKs and two on-chain programs — and everything else people call "the pump.fun API" is either an undocumented endpoint the website talks to, or a third-party service reselling indexed Solana data with its own fee on top.

That gap is why the search results for this keyword are a mess of unofficial GitHub repos, paid data vendors, and Reddit threads where someone asks the pump.fun team for API access and is told everything is closed source. This guide maps the four layers that genuinely exist in September 2026, with the real package versions, the real fee schedules, and the real response payloads — including a field list pulled live from the undocumented endpoint while writing this. If you are building on pump.fun, the question is not "where are the docs" but "which layer do I actually need", and the answer changes your latency and your costs by an order of magnitude.

Direct answer: pump.fun is a Solana program, not a web service. Every launch, buy, sell, and graduation is an instruction sent to an on-chain program, and every piece of state you might want to read — a coin's bonding curve, its reserves, its creator, its market cap — lives in a Solana account you can fetch with a plain RPC call. There is no server in between that you need permission from.

That single architectural fact explains the whole landscape. Because the data is public on-chain, anyone can index it and sell access, which is why a dozen "pump.fun API" products exist. And because the write path is a program instruction, anyone can trade programmatically without asking pump.fun for anything — you just need to build the right instruction and sign it.

Two programs matter, and both are verifiable on mainnet right now:

• The bonding curve program — 6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P. This is where a coin lives from launch until it graduates: creation, buys, sells, and the curve state itself.
• The PumpSwap AMM program — pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA. Once a coin completes its curve it trades in a constant-product pool here. If you are only watching the curve, you lose the coin the moment it graduates — which is exactly when volume peaks. Our PumpSwap explainer covers how that side of the venue prices trades.

So the four layers of "pump fun API", from most official to least:

Layer	What it is	Official?	Costs you
On-chain programs + npm SDKs	Instruction builders and account decoders for both programs	Yes — published by pump.fun	Your RPC bill only
The frontend API	The undocumented JSON endpoints the pump.fun website itself calls	Real but unsupported	Nothing, until it rate-limits you
Third-party trading APIs	HTTP services that build or send pump.fun transactions for you	No — explicitly third party	0.5%–1% per trade
Indexed data vendors	GraphQL / WebSocket / gRPC over a normalised copy of the chain	No	Monthly subscription

Direct answer: pump.fun publishes official SDKs, not an official hosted API, and it does not issue API keys. If a site is selling you a "pump.fun API key", that key authenticates you to that company's servers — not to pump.fun.

This distinction is worth being precise about, because it changes what you are exposed to:

• An SDK is code you run. It builds a Solana instruction locally, you sign it with your own keypair, and you send it through your own RPC. Nothing leaves your process except the signed transaction. No third party can rate-limit you, front-run you, or go offline and take your bot down.
• A hosted API is a server you trust. Someone else builds the transaction, or worse, holds the key that signs it. Convenient in an afternoon, a liability in production.

The practical consequence: every honest tutorial that promises "the pump.fun API in 10 lines of Python" is using a third-party wrapper. That is not automatically bad — but you should know you are paying a spread for it, and price it against the 0.5%–1% fees we break down below.

Two packages, both MIT-licensed, both under the @pump-fun npm scope, both actively shipped — the bonding curve SDK was last published on 13 September 2026 and the AMM SDK on 10 September 2026, which tells you the release cadence you are signing up to track.

@pump-fun/pump-sdk — the bonding curve {#pump-sdk}

@pump-fun/pump-sdk (v2.0.0 at the time of writing, described simply as "Pump Bonding Curve SDK") is the package for everything pre-graduation. The shape is a class you hand a connection:

import { Connection } from "@solana/web3.js";
import {
  PumpSdk,
  getBuyTokenAmountFromSolAmount,
} from "@pump-fun/pump-sdk";
import BN from "bn.js";

const connection = new Connection(process.env.RPC_URL!, "confirmed");
const sdk = new PumpSdk(connection);

// Global config + this coin's curve + your token account, in one helper
const global = await sdk.fetchGlobal();
const {
  bondingCurveAccountInfo,
  bondingCurve,
  associatedUserAccountInfo,
} = await sdk.fetchBuyState(mint, user);

const solAmount = new BN(0.1 * 10 ** 9); // 0.1 SOL, in lamports

const instructions = await sdk.buyInstructions({
  global,
  bondingCurveAccountInfo,
  bondingCurve,
  associatedUserAccountInfo,
  mint,
  user,
  solAmount,
  amount: getBuyTokenAmountFromSolAmount(global, bondingCurve, solAmount),
  slippage: 1, // percent, not basis points
});

Three things in that snippet are easy to get wrong. Amounts are BN values in the mint's raw units, so lamports for SOL and micro-units for a USDC-quoted curve — not floats. slippage: 1 means one percent, not one basis point. And getBuyTokenAmountFromSolAmount is the curve maths: it is what turns "I want to spend 0.1 SOL" into the token amount the program expects, so you do not reimplement the invariant yourself and drift out of sync when the program changes.

Selling mirrors it exactly — fetchSellState then sellInstructions. Note that these are instruction builders, not senders: you assemble the transaction, add your own compute-unit and priority-fee instructions, and submit it. That is a feature. Priority fees are the single biggest lever on whether your transaction lands in a contested block, and a hosted API that picks them for you is guessing on your behalf. Our breakdown of Solana transaction fees covers how to size them.

The SDK also exposes an offline/online split that matters at scale. The singleton PUMP_SDK builds instructions from state you already have, with zero RPC calls; OnlinePumpSdk fetches that state for you. If you are streaming curve accounts anyway, use the offline builders and skip the round-trip entirely.

@pump-fun/pump-swap-sdk — the AMM {#pump-swap-sdk}

@pump-fun/pump-swap-sdk (v1.20.0, described as the official SDK for the Pump Swap AMM protocol) is the post-graduation half, and it is structured the same way: PUMP_AMM_SDK for offline building, OnlinePumpAmmSdk for fetching, PumpAmmAdminSdk for admin-gated instructions.

import { OnlinePumpAmmSdk, PUMP_AMM_SDK } from "@pump-fun/pump-swap-sdk";

const onlineSdk = new OnlinePumpAmmSdk(connection);
const state = await onlineSdk.swapSolanaState(poolKey, user);

// Spend an exact amount of quote, receive base minus slippage
const buy = await PUMP_AMM_SDK.buyQuoteInput(state, quoteAmount, 1);

// Sell an exact amount of base, receive at least quote minus slippage
const sell = await PUMP_AMM_SDK.sellBaseInput(state, baseAmount, 1);

The four swap builders — buyBaseInput, buyQuoteInput, sellBaseInput, sellQuoteInput — are named for which side you are fixing. The same four exist as pure pricing functions exported from the package root, which is what you call when you want to show a quote in a UI before anyone signs anything. Alongside them sit helpers like computeFeesBps and poolMarketCap, so you are not reverse-engineering the fee schedule from transaction logs.

One under-documented detail worth knowing: swapSolanaState reads the token programs from the mint owners rather than assuming the legacy SPL Token program, so Token-2022 quote mints work. The builders also wrap and unwrap wSOL for you on SOL-quoted pools and create your missing base ATA on a buy — but on a non-SOL quote they expect your quote token account to already exist. That asymmetry has broken more than one first deployment.

"Bonding curve API" is one of the most common long-tail searches here, and it has a disappointingly simple answer: it is a getAccountInfo call plus a decoder. PumpSdk.decodeBondingCurve turns the raw account bytes into reserves, the creator, and the flags.

The part nobody warns you about is that the account has grown three times. The BondingCurve layout went from 115 bytes to 124 when configurable creator fees shipped, then to 125 when holder-reward coins arrived; Global went 1045 → 1054 → 1087. The SDK's decoder reads every historical length and defaults the missing fields, which is why you should decode through it rather than slicing bytes by hand — a hand-rolled parser pinned to one layout silently misreads older coins.

Two recent program changes are worth having on your radar if you are writing anything that decodes events:

• Holder-reward coins. A coin can now route its creator fee to its holders instead of a wallet, by making a per-mint PDA the creator. BondingCurve.isHolderReward flags it, and TradeEvent reports the same fee twice — once in the unchanged creatorFee fields, once in new holderRewards fields that read as zero on every other coin. Double-count that and your fee analytics are wrong.
• Cashback is deprecated. New coins cannot enable it — the program rejects the attempt outright. Existing cashback coins still behave as before. If your indexer branches on cashback, that branch is now historical only.

If you would rather not maintain a decoder against a moving program at all, that is a legitimate reason to use a vendor — or to stop building the pipeline and copy the wallets already trading it.

The pump.fun website is a normal web app, and it fetches JSON from frontend-api-v3.pump.fun. Those endpoints are open, they work, and they are not documented anywhere official — the unofficial GitHub repo at the top of Google's results for this keyword exists precisely because someone mapped them by watching network requests.

A request like GET https://frontend-api-v3.pump.fun/coins?limit=1&sort=created_timestamp&order=DESC returns the newest launch as a JSON array. Fetched while writing this in September 2026, a single coin object carried 45 fields, including:

• Identity — mint, name, symbol, description, creator, username, image_uri, metadata_uri, created_timestamp.
• Curve state — bonding_curve, associated_bonding_curve, virtual_sol_reserves, virtual_token_reserves, real_sol_reserves, real_token_reserves, virtual_quote_reserves, real_quote_reserves, complete.
• Valuation — market_cap, market_cap_usd, market_cap_quote, usd_market_cap, total_supply.
• Venue and quote — program, protocol, pool_address, quote_mint, quote_decimals, quote_token_program, base_decimals, token_program, multichain_family, chain_id.
• Flags — is_holder_reward, is_cashback_enabled, is_currently_live, is_banned, nsfw, verified, boost_mode, reply_count.

That is_holder_reward field is a useful tell: the frontend API tracks the same program-level changes the SDK does, so it is a genuinely current view of state rather than a stale mirror.

Now the three reasons not to build a business on it. First, it is rate-limited hard and without warning — two requests in quick succession during research returned {"statusCode":429,"message":"Rate limit exceeded. Please slow down.","retryAfterMs":51}. Honour that retryAfterMs, because there is no documented quota to plan around. Second, the hostname has already moved once: the older frontend-api.pump.fun now returns a Cloudflare origin error, so anything hardcoded against it is dead. The -v3 suffix is a promise that a -v4 is coming. Third, there is no support contract. When it changes shape, you find out from your error logs.

Reasonable use: a research script, a dashboard you babysit, or metadata enrichment on a coin you already found on-chain. Unreasonable use: the detection path of a bot with money on it. Same verdict we reached on read-only discovery layers in the DexScreener API and DEXTools API guides — great for context, wrong for triggers.

Direct answer: you cannot get one from pump.fun, because pump.fun does not issue them. Every "pump.fun API key" is a credential for a third-party service. When you search for one, you are being routed to a vendor, and the honest framing of your choice is:

• No key at all. Use the official SDKs and your own RPC endpoint. Your RPC provider's key is the only credential in the system. This is the fastest and the cheapest path, and it is the one professional desks take.
• A transaction-building key. A service returns a serialised transaction that you sign locally. You keep custody; you pay a percentage.
• A custodial key. A service generates a wallet, holds the private key, and trades with it when you call the API. Easiest to start, and the thing to think hardest about — anyone with that key can move the funds.

If you take nothing else from this article: a key that can spend your money is not an API key, it is a wallet. Treat it accordingly.

Two names dominate this SERP, and they solve different problems. Figures below are each provider's own published pricing as of September 2026 — verify before you commit, because these change.

Provider	What you get	Published cost	Custody
PumpPortal — Local Transaction API	POST returns a serialised transaction; you sign and send it	0.5% per trade	You keep keys
PumpPortal — Lightning Transaction API	They generate the wallet and send the transaction for you	1% per trade	Key held by the service
PumpPortal — Data API	WebSocket: new tokens, migrations, per-token and per-account trades	Launches and migrations free; trade streams metered at 0.01 SOL / 10,000 events	Needs a funded linked wallet
Bitquery	GraphQL over indexed history, plus streaming tiers	Plans from $49/mo; streaming from $99/mo; 7-day trial	Read-only, no keys at risk
Solana RPC + Geyser gRPC	Raw account and transaction streams; you decode with the official SDKs	Your provider's plan	Read-only

PumpPortal's Local API is the sane middle ground of the hosted options: you send a POST to https://pumpportal.fun/api/trade-local with publicKey, action (buy or sell), mint, amount, denominatedInSol, slippage, priorityFee, and an optional pool — which accepts pump, pump-amm, raydium, raydium-cpmm, launchlab, bonk, or auto. You get back a serialised transaction to sign yourself. That pool list is doing real work: it is venue routing, the part of a DIY bot that breaks every time volume migrates to a new AMM.

But price the fee honestly. Half a percent per trade, charged on entry and exit, is one percent round-trip. On a scalping strategy turning over its book several times a day, that is the difference between a profitable and an unprofitable system — and it sits on top of the bonding curve's own fee and your priority fees. Convenience has a spread, and on high-frequency memecoin flow that spread is the strategy.

"Pump fun websocket api" is where the search intent and the engineering reality diverge most, so here is the ranking, worst to best.

Polling the frontend API. You will hit 429s, and you are adding your poll interval to every signal. Fine for a dashboard, hopeless for entries.

A vendor WebSocket. PumpPortal's stream at wss://pumpportal.fun/api/data takes an API key as a query parameter and accepts subscribeNewToken, subscribeMigration, subscribeTokenTrade, and subscribeAccountTrade methods over one connection. Launches and migrations are free; trade and account streams are metered, and subscribing requires a linked wallet funded with at least 0.02 SOL. Since 1 May 2026, trading data has required a key at all. Open one connection and multiplex your subscriptions over it — opening a socket per token is how you get temporarily banned.

Solana WebSocket logsSubscribe. A real push stream from your own RPC, filtered on the program address. The catch is that logs are not full transaction metadata, so you need a follow-up getTransaction to know what happened — which puts a round-trip back in your hot path. Subscriptions also drop silently on shared endpoints, so build a heartbeat.

Yellowstone gRPC (Geyser). The professional answer, and the one every fast pump.fun bot is actually using. A Geyser plugin streams transactions straight from a validator with metadata attached, filtered server-side to the accounts you care about, and you subscribe at processed commitment rather than waiting for confirmation. Helius, Triton, and QuickNode all expose it. You decode the resulting CreateEvent and TradeEvent payloads with the official SDK's decoders, and you are reading the chain at close to the speed the validator sees it.

The rule of thumb: if a signal triggers a trade, stream it over gRPC; if it only decorates a screen, an HTTP call is fine. Mixing those up is the most expensive architectural mistake in this space, and it is the same one we quantified in detail when walking through building a copy trading bot in Python.

Launching through code is a first-class path in the official SDK, not a hack. createInstruction builds the launch; createAndBuyInstructions bundles the launch and the dev buy into one transaction, which is the pattern you want if you do not intend to be sniped by the first bot that sees your mint. You pass name, symbol, and a metadata uri you have already uploaded somewhere persistent — the SDK does not host your image for you.

The v2 creation path adds the holder-reward option: pass holderReward: true and the program ignores whatever creator you supplied, routing the coin's creator fees to a per-mint PDA that pays out to holders instead of a wallet. It is permanent. There is no instruction to undo it later, so decide before you launch rather than after.

Worth saying plainly: being able to launch a coin in one transaction is also why so much of the supply on this venue is disposable. Our guides to creating a memecoin and to the wider Solana launchpad landscape cover the part the SDK cannot help with, which is anyone caring.

The official SDKs are TypeScript only, which is the single biggest practical reason Python developers end up on third-party APIs. Your three options, honestly framed:

• TypeScript, using the official SDKs. Least code, no fee spread, and you inherit upstream fixes when the program changes. If you have no strong language preference, pick this.
• Python, calling a transaction-building API. This is what almost every Python pump.fun tutorial does — POST for a serialised transaction, then sign it with solders and send it with solana-py. It works today and costs you the provider's percentage forever.
• Python, building instructions yourself. Decode the program IDL with anchorpy and construct instructions directly. No fee, full control, and you now personally own a decoder against a program that changed its account layout three times in a year.

Whichever you pick, route your swaps thoughtfully once a coin has graduated — Jupiter will often price a post-graduation trade better than hitting a single pool, and it hides the venue question behind one interface.

Every layer above is plumbing. None of them contain a strategy, and that is the part people quietly expect an API to supply.

Specifically: the API will not tell you which of the thousands of coins launched today is worth buying. It will not tell you when to sell. It will not notice that the wallet you are mirroring just changed behaviour. And it will not protect you from a mint whose deployer holds ninety percent of supply — for that you want a rug check in the path, and an awareness that on Solana you are also trading against MEV infrastructure that is faster than your bot.

Which leads to the honest cost comparison. A production-grade pump.fun pipeline means a gRPC subscription, a decoder you maintain against a moving program, venue routing across the curve and the AMM, priority-fee logic, a durable position store, and someone awake when it breaks at 3am. That is real infrastructure work for an edge you have not yet proven you have.

The alternative is to skip the pipeline and copy the wallets that already have the edge. uwuu is non-custodial — your keys stay in your wallet, and a copy key mirrors a chosen trader's positions with sub-400ms execution, picked from a leaderboard whose performance is verifiable on-chain rather than self-reported. Fees are performance-based: you pay when you profit. It is not a replacement for the SDK if you are building a product, but if your actual goal was "trade pump.fun programmatically", it is the shortest route there. Compare it against the DIY options in our Solana trading bot guide and the pump.fun bot ranking.

Does pump.fun have an API?

Not a hosted one. pump.fun publishes two official TypeScript SDKs — @pump-fun/pump-sdk for the bonding curve and @pump-fun/pump-swap-sdk for the PumpSwap AMM — that build Solana instructions you sign and send yourself. The undocumented frontend-api-v3.pump.fun endpoints the website uses are real but unsupported, and every other "pump.fun API" is a third-party service.

Is the pump fun API free?

The official SDKs are free and MIT-licensed, so your only cost is your Solana RPC plan plus network and bonding-curve fees. Third-party trading APIs charge per trade — PumpPortal publishes 0.5% on its Local API and 1% on its Lightning API — and indexed data vendors like Bitquery start at $49/mo on their published pricing.

How do I get a pump fun API key?

You cannot get one from pump.fun, because it does not issue API keys. Any key you obtain belongs to a third party: a data vendor, or a transaction service. If that key can sign transactions with funds, treat it as a wallet private key rather than a credential.

Where is the pump fun API documentation?

The official documentation is the two npm packages and their READMEs, published under the @pump-fun scope with source on GitHub. There is no official REST reference. The unofficial endpoint maps you will find on GitHub were assembled by watching the website's network traffic and can go stale without notice.

Can I use the pump fun API with Python?

Not officially — the SDKs are TypeScript. Python developers either call a third-party transaction-building endpoint and sign the result with solders, or decode the program's IDL with anchorpy and build instructions directly. The second is free but means maintaining your own decoder against a program whose account layout has changed several times.

Can the pump fun API copy another wallet's trades?

No. Nothing in the SDKs or the third-party APIs does wallet mirroring — you would have to stream the target wallet over gRPC, decode its trades across both the curve and the AMM, size your own position, and execute, which is a full system rather than an API call. A non-custodial copy trading platform does that part for you while your keys stay in your wallet.

If you are building a product on pump.fun, use the official SDKs with your own RPC and Geyser stream. It is the only layer with no fee spread, no third-party outage risk, and no credential that can spend your money — and it is maintained by the people who ship the program.

If you are prototyping, the undocumented frontend endpoints and a free launch stream will get you moving in an afternoon. Just do not let that prototype become production without replacing the detection path.

And if you came here because you wanted to trade pump.fun automatically rather than build developer tooling, be honest that the API was never the hard part. Detection, selection, sizing, and exits are, and a memecoin trading bot you wrote yourself has to win all four. Copying a trader with a verifiable on-chain record skips straight to the only question that ever mattered: whose trades are worth mirroring?