API Keys (self-service)

Status: Live in production. Manage keys in the web UI at app.rocky.exchange/keys or via the endpoints below.

GET /v1/api-keys · POST /v1/api-keys · DELETE /v1/api-keys/{id}

Create, list and revoke the API keys used to sign /api/v3 and /fapi requests, from a wallet session. The web app's API Keys page is a thin client of these three calls.

Auth: Authorization: Bearer <session_token> from POST /v1/wallet/verify. Keys belong to the session's user; the session key the browser mints for spot trading (spot-session:<party>) is never listed or revocable here.

Rules

New keys are always on the standard rate tier. Market-maker tiers (ext-mm) are assigned by Rocky operations during onboarding; they are never self-served.
At most 10 active keys per account (409 beyond that).
label is optional, at most 64 characters, no control characters. The prefixes spot-session:, mm- and taker- are reserved (400).
key_type is HMAC (default) or ED25519. An HMAC secret is returned once, in the creation response only. An Ed25519 key stores only your public key; you sign with the private key you generated.
A key's type cannot change; create a new key and revoke the old one.

List — `GET /v1/api-keys`

Query	Default	Notes
`include_revoked`	`false`	`true` also returns revoked keys with `revoked_at`.

{
  "keys": [
    {
      "id": "8a0c1d2e-…",
      "key": "3f9b…c2e1",
      "label": "quoter-prod",
      "key_type": "ED25519",
      "rate_tier": "ext-mm",
      "created_at": "2026-09-07T10:00:00Z",
      "public_key": "6kpsY+KcUgq+9VB7Ey7F+ZVHdq6+vnuSQh7qaRRG0iw="
    },
    {
      "id": "1b2c3d4e-…",
      "key": "a71d…08ff",
      "label": null,
      "key_type": "HMAC",
      "rate_tier": "standard",
      "created_at": "2026-09-01T08:30:00Z"
    }
  ]
}

key is the value you send in X-MBX-APIKEY. HMAC secrets are never returned by this endpoint.

Create — `POST /v1/api-keys`

{ "label": "quoter-prod", "key_type": "HMAC" }

{ "label": "quoter-prod", "key_type": "ED25519", "public_key": "6kpsY+KcUgq+9VB7Ey7F+ZVHdq6+vnuSQh7qaRRG0iw=" }

Field	Required	Notes
`label`	no	See rules above.
`key_type`	no	`HMAC` (default) or `ED25519`, case-insensitive.
`public_key`	for `ED25519`	Base64 (standard or URL-safe) of the 32-byte Ed25519 verifying key; must be a valid point. Stored re-encoded in standard base64.

Response — 200 (HMAC): the key object plus secret

{
  "id": "1b2c3d4e-…",
  "key": "a71d…08ff",
  "label": "quoter-prod",
  "key_type": "HMAC",
  "rate_tier": "standard",
  "created_at": "2026-09-07T10:00:00Z",
  "secret": "9c4e…77b0"
}

For ED25519 the response carries public_key and no secret.

HTTP	cause
`400`	Bad label, unknown `key_type`, missing or invalid `public_key`.
`401`	Missing or expired session.
`409`	Already 10 active keys.

Revoke — `DELETE /v1/api-keys/{id}`

{ "id": "1b2c3d4e-…", "revoked_at": "2026-09-07T11:00:00Z" }

Revocation is immediate: the next signed request with that key answers -2015. 404 when the id is not yours, already revoked, or a session key.

See Authentication for how to sign with either key type, and the Quickstart for code.

List — GET /v1/api-keys​

Create — POST /v1/api-keys​

Revoke — DELETE /v1/api-keys/{id}​

List — `GET /v1/api-keys`

Create — `POST /v1/api-keys`

Revoke — `DELETE /v1/api-keys/{id}`