API keys
Creating an API key, choosing its permissions, and what to do when a secret is lost.
An API key authenticates your application to the REST and WebSocket APIs. It has two parts, and they are used very differently.
| Part | What it is | How it is used |
|---|---|---|
| API key | A public identifier | Sent on every request, in the Rest-Key header |
| API secret | A private credential | Signs the request. Never sent over the network |
The secret never leaves your systems. It is used to compute a signature, and only the signature travels — see Authentication.
Creating a key
- Sign in to the client portal for your entity and environment.
- Open Settings, then API keys.
- Choose Create API key.
- Optionally tick Add RSA public key and paste one, if you intend to use signed order intent. This can be added or changed later.
- Choose Submit, then confirm with the one-time code from your authenticator.
- The new secret appears above the key list. Copy it straight away.
Permissions
Permissions are set on the key list, not while creating the key: a new key starts with none, and you switch on what the application actually needs.
| Permission | Grants |
|---|---|
| Move funds | Moving balances between sub-accounts |
| Place & manage orders | Executing trades over the RFS WebSocket |
A key with neither is read-only. That is the right setting for anything that only queries balances, trades or transactions.
Changing a key
Each key's actions menu offers Edit — which changes the attached RSA public key — Reset secret, and Delete. Editing and resetting both require a one-time code, the same as creation.
Using more than one key
Separate keys per application and per environment are worth the small overhead: they let you give each system only the permissions it needs, rotate one without interrupting the others, and withdraw access to one system without touching the rest.