Authentication
Create a key on your account page. It spends that account's balance.
Stock needs no key. Products works without one, and with one shows your own prices. Everything else needs a key.
Getting a key
- Sign in, open your account page and press Create API key.
- The key is shown once and never again, because we store only its hash. Copy it straight away.
- Up to five active keys per account. Revoke one at any time and it stops working at once.
- A key is full (can buy, replace and manage webhooks) or read-only (can look things up). Give monitors and teammates read-only keys.
Sending it
| Where | How |
|---|---|
| Header, recommended | X-Api-Key: rsk_... |
| Header | Authorization: Bearer rsk_... |
| Query string | ?key=rsk_... works, but avoid it. |
A key on the query string is part of the URL, so it is written into access logs, proxy logs and browser history wherever the request passes. A header is not. If you have been sending ?key=, switch to X-Api-Key and replace the key on your account page.
What it spends
A key spends the balance of the account that created it, the same balance you see on your account page. Every key on the account shares that balance and the same buy rate limit. There is no credit and no overdraft: if your balance does not cover an order, it is refused with E1401 and nothing is charged.
curl "https://www.nfa.pub/api/v1/balance" \ -H "X-Api-Key: rsk_..."0.90To check which key you are using and what it may do, call /me.
Errors
| Code | HTTP | Meaning |
|---|---|---|
E1001 | 401 | The key is missing, malformed, revoked or unknown. |
E1701 | 403 | This key is read-only. It can look things up, but not buy, replace, change or cancel a pre-order, export logins with include=accounts or change webhooks. |
E1702 | 403 | The request came from an IP that is not on your allowlist. |