API keys

Use dashboard to manage operator API credentials safely.

Recommended key split

• launch key: launch:write
• reporting key: read scopes only, such as users:read, markets:read, trades:read, redemptions:read, and balance_operations:read
• market visibility automation key: markets:read, markets:write
• wallet adapter automation key: wallet_adapter:read, wallet_adapter:write only when a backend service must manage adapter config
• webhook admin key: webhooks:read, webhooks:write
• staging simulator key: simulator:read, simulator:write

Avoid one all-purpose key unless operationally necessary.

Staff account management is not available to API keys. Staff APIs require a human staff session with staffs:read or staffs:write.

Create flow

1. choose clear key name by workload
2. assign minimum scopes
3. store token in secret manager immediately
4. test one expected endpoint

See scope list at /docs/reference/scopes.

Rotation flow

1. create replacement key first
2. deploy replacement secret to operator systems
3. verify new key works
4. revoke old key

Do not revoke old key before replacement is live.

Revocation guidance

Revoke immediately if:

• token leaked to logs or chat
• token committed to repo
• token shared outside approved operators
• unknown traffic appears

Troubleshooting

• INVALID_API_KEY -> token wrong, revoked, or sent to wrong environment
• INSUFFICIENT_SCOPE -> wrong scope set
• INVALID_SCOPES during creation -> unsupported scope name
• staffs:read and staffs:write are not valid API key scopes

Related pages

• API contract: /docs/operator-api/api-keys
• current session introspection: /docs/operator-api/session