API keys

Use API Keys to connect your applications to the Management API. You do not need an API key to navigate Console or sign in to a trading account in Terminal.

Before you begin

Use an Owner, Admin, or Developer role. Decide which operations your application needs, and arrange API credits before it starts making authenticated requests.

Create a key

1. Open API Keys

   Click API Keys in the bottom dock, then Create Key.

2. Give the key a clear name

   Enter Name, such as Apex reporting. Use a separate key per application or purpose so you can identify and revoke it independently.

3. Select only the required scopes

   Under Scopes, select the permissions the application needs. For a credit-balance check, choose credits:read. Avoid adding write or finance scopes to a read-only reporting application.

4. Create and save the secret

   Click Create. In New API Key, click Reveal secret, then Copy. Store it securely before clicking I have saved this secret or leaving the page.

5. Connect your application

   Follow the Management API quickstart. Use the public Management API address and authentication instructions there.

Warning

The full API key is shown only during creation. Do not put it in browser code, a public repository, screenshots, or support messages. If you lose it, create a replacement and revoke the old key; the list does not reveal it again.

Choose scopes

Scope	Purpose
accounts:read	Read trading accounts, server configuration, and command results; export supported history.
accounts:create	Create trading accounts.
accounts:update	Change accounts, reset credentials, and update server configuration through supported API operations.
finance:deposit	Increase a trading account’s ledger balance.
finance:withdraw	Decrease a trading account’s ledger balance.
metrics:read	Read metric snapshots and subscribe to live account metrics.
credits:read	Read the organization’s API credit balance.
webhooks:manage	Reserved; no public Management API endpoint currently uses this scope.

See API scopes for the full operation mapping.

Note

Keys created by the current Console form have access to all servers in the organization, limited by their selected scopes. This form does not offer a server selector or expiry setting. Do not assume a name such as Demo reporting restricts a key to a demo server.

Review existing keys

The table shows Name, Prefix, Scopes, and Last Used. Never means no last-use timestamp is available. A prefix helps identify a key but is not a usable secret.

For a planned replacement, create and securely configure a new key, verify the integration with it, then revoke the old key. If a key is exposed, revoke it promptly and repair affected integrations with a replacement.

Revoke a key

1. Find the key in API Keys.
2. Click Revoke.
3. Read the confirmation and click Revoke again.

Revocation invalidates the key immediately and cannot be undone. Requests still using it will fail authentication. Creating or revoking a Management API key does not change a trader’s Terminal password.