Skip to main content

​
Endpoints

EndpointMethodDescriptionRate Limit
/v1/api-keysPOSTGenerate new API key5 req/min
/v1/api-keysGETList user’s API keys5 req/min
/v1/api-keys/{id}DELETERevoke API key5 req/min
Authentication: JWT token (from web login)

​
Generate API Key

Create a new API key for programmatic access. Request: 
POST /v1/api-keys
Authorization: Bearer {jwt_token}
Content-Type: application/json

{
  "name": "Trading Bot #1",
  "permissions": ["trade", "read"]
}
Response: 
{
  "id": "key_abc123",
  "name": "Trading Bot #1",
  "api_key": "pk_live_...",
  "api_secret": "sk_live_...",
  "created_at": "2026-01-13T10:00:00Z",
  "permissions": ["trade", "read"]
}
The api_secret is only shown once. Store it securely - you cannot retrieve it again.

​
List API Keys

Get all active API keys for your account. Request: 
GET /v1/api-keys
Authorization: Bearer {jwt_token}
Response: 
{
  "keys": [
    {
      "id": "key_abc123",
      "name": "Trading Bot #1",
      "api_key": "pk_live_...",
      "created_at": "2026-01-13T10:00:00Z",
      "last_used": "2026-01-13T15:30:00Z",
      "permissions": ["trade", "read"]
    }
  ]
}
The api_secret is never returned in list responses for security reasons.

​
Revoke API Key

Delete an API key to prevent further access. Request: 
DELETE /v1/api-keys/{key_id}
Authorization: Bearer {jwt_token}
Response: 
{
  "success": true,
  "message": "API key revoked"
}
Revoking a key immediately invalidates all requests using that key. WebSocket connections will be disconnected.

​
Best Practices

  • Name your keys descriptively - Use names like “Production Bot” or “Testing Strategy #2”
  • Rotate keys regularly - Create new keys and revoke old ones every 90 days
  • Use separate keys per bot - Easier to track usage and revoke if needed
  • Monitor last_used timestamps - Detect unused or potentially compromised keys
  • Revoke immediately if compromised - Don’t wait if you suspect a key has been exposed