Docs
API keys

Create a key

POST
/v1/api-keys

Needs an admin key (fx_admin_…), made by the workspace owner in the console — or a signed-in owner or admin. Ordinary API keys are refused with ADMIN_KEY_REQUIRED.

Returns the key in key, once. We cannot show a key again after creation, or recover it. A lost key is replaced, not recovered.

admin, keys:manage, members:manage and billing:manage cannot be granted here, not even by an admin key. Issue narrow keys: an integration that only reads positions should hold trading:read and nothing else.

A console session confirms it's you first (403 STEP_UP_REQUIRED) only when the key can move money or accounts — trading:execute, trading:reduce or accounts:write. A read-only key, or one that only manages webhooks, is created without one.

Authorization

adminKey
AuthorizationBearer <token>

Authorization: Bearer fx_admin_<id>_<secret>.

An admin key manages this workspace's ordinary API keys (/v1/api-keys) and can do nothing else. Only the workspace owner makes one, in the console, optionally limited to IP addresses and given an expiry. Every request made with one is audited.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/api-keys" \  -H "Content-Type: application/json" \  -d '{    "name": "Production trading server",    "scopes": [      "accounts:read"    ]  }'
{  "data": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "name": "string",    "publicId": "string",    "hint": "string",    "environment": "live",    "scopes": [      "string"    ],    "lastUsedAt": null,    "expiresAt": null,    "revokedAt": null,    "createdAt": "2019-08-24T14:15:22Z",    "limits": null,    "createdBy": null,    "createdByAdminKey": null,    "key": "string"  }}