devoracles.

NewsDeveloper Tools & SDKs

Pyth Network API Migration Risks Breaking 300 DeFi Protocols Without Key Updates

According to CryptoSlate, Pyth Network has completed its Hermes migration, and with it, API keys are now mandatory for any developer directly calling its price service.

Pyth Network API Migration Risks Breaking 300 DeFi Protocols Without Key Updates

Picture this: your integration with Pyth has been humming along for months, and then one morning the price feed just stops responding. No bug in your code, no deploy on your end — the oracle moved. According to CryptoSlate, Pyth Network has completed its Hermes migration, and with it, API keys are now mandatory for any developer directly calling its price service. The blast radius is what turns a routine deprecation into a cliff: the change potentially touches more than 300 DeFi protocols that together secure roughly $2.7 billion.

What actually changed under the hood

The mechanic on the surface is small — every direct caller now needs a key attached to the request — and the reach underneath is enormous. If your team pulls prices through a wrapper, a hosted partner front end, or a third-party relayer, the path between you and the feed may have already absorbed the change, or it may not have. Worth opening that box and looking rather than assuming.

The good news: this is not a feature rewrite. It is a key-rotation story. Treat it like the unsexy boilerplate work that keeps your protocol alive — painful for a day, easy to triage once you see the shape of it.

What to check in your own stack

Let us walk through this together. First, find every direct call into the Pyth price service — search your repos for the price endpoint string, any vendored client libraries, and any off-chain worker that republishes or aggregates feeds. Anywhere a request is firing without a key is where the breakage lives.

Next, look at your keys. Who owns them, where do they live (env var, KMS, secrets manager?), and what does rotation actually look like in production? A burnt key with no graceful fallback is going to be a much louder alarm than a clean swap, so design the retry path before you need it.

Finally, if you consume through a partner, ping them. They have either already migrated and simply not flagged it, or they are still happily calling the old public path and about to have the same Friday afternoon you are trying to avoid. A short message now saves a war room later.

A second deadline worth watching

Oracle-dependent codebases are looking at more than one timeline right now. According to CryptoRank, Ethereum's Glamsterdam candidate — spanning EIP-8037 and EIP-8038 — is aimed at roughly three times the base-layer throughput, with a Q4 2026 testing window on the roadmap. The repricing introduces a 1,530 gas-per-byte state charge and lifts the cost of new accounts from 25,000 to 183,600 gas and storage slots from 20,000 to 97,920. A replay of nearly 930 million transactions through a public dashboard found 174.5 million replay-fixes available under EIP-8037 and 84.7 million under EIP-8038 — but somewhere between roughly 2.69 million and 3.04 million transactions look potentially broken. Both proposals still sit in formal Review status, so nothing is final, yet if your contracts or your relayer code make assumptions about state-creation costs, this is the window to start poking at it on a testnet.

The short version: pin down your Pyth key story this week, and keep one eye on the Glamsterdam spec calls over the coming months. Two deprecation clocks, two different shapes, same playbook — read the release notes before your users read them first.