# How to verify API3 oracle sources before a DeFi integration

Canonical: https://chainincident.com/news/c8deb210-63fa-43a8-afa7-9d318343d9f2
Published: 2026-09-11T02:22:03.972Z
Publisher: Chain Incident

API3 documents a practical route from checking a provider’s signed-data endpoint to confirming the contract and update settings a DeFi app will use.

API3 gives developers a way to inspect oracle provenance in its Market interface. Its integration guide explains how hovering over a provider’s logo displays source verification, while the Verified link opens the provider’s signed-data service. That creates a concrete starting point for checking who supplies a feed before connecting an application. [docs.api3.org](https://docs.api3.org/dapps/integration/)

The documented checks cover provider identity, certification of signing keys and access to signed data through the provider itself. API3 feeds combine individual readings using an on-chain median. These checks expose the sources behind a feed. API3’s security documentation also directs developers to assess contract implementation and privileged accounts. [docs.api3.org](https://docs.api3.org/dapps/integration/); [docs.api3.org](https://docs.api3.org/dapps/integration/security-considerations.html)

For deployment, the contract guide directs teams to confirm both an active Market feed and a contract at the expected proxy address. It also specifies 18 decimal places for feed values and explains that the returned timestamp reflects provider-reported time, rather than the update’s block time. Those distinctions give reviewers specific integration assumptions to test. [docs.api3.org](https://docs.api3.org/dapps/integration/contract-integration.html)

API3 also publishes its control model: a four-of-eight technical-team multisig can upgrade the reader proxy, while a separate four-of-four multisig approves provider configurations. The security guide links audit material and describes a 0–15-second delay in the base feed used for OEV. Teams can use these disclosures to assess whether the feed’s operation fits their application. [docs.api3.org](https://docs.api3.org/dapps/integration/security-considerations.html)

## Sources

- [Contract integration | Api3 documentation](https://docs.api3.org/dapps/integration/contract-integration.html) — docs.api3.org
- [Using Api3 Market | Api3 documentation](https://docs.api3.org/dapps/integration/) — docs.api3.org
- [Security considerations | Api3 documentation](https://docs.api3.org/dapps/integration/security-considerations.html) — docs.api3.org

- [Editorial policy](https://chainincident.com/editorial-policy)
- [Request a correction](https://chainincident.com/corrections)