API keys
Make, scope, rotate and revoke keys; sandbox and live keys; what to do when a key leaks.
#Making a key
Keys are made only in the web app, under Account → Developer API (signed in). The API itself cannot make, widen or restore keys, so a leaked key can never mint another one.
- Accept the API terms (once).
- Give it a label and, if you like, fewer scopes than all, an expiry date and an IP allow list.
- Copy the key: it is shown once. ChartDeck stores only a fingerprint of it.
A key looks like cdk_ followed by 43 characters. The first 12 characters (the prefix) are shown in your key list, in /v1/me and in the admin tools, so you can tell keys apart without exposing them.
Up to 10 live keys per account; all of them share the account's limits. Whether a key reads live or recorded data depends on the account's tier, not on the key: without an API tier the account is on the sandbox.
#Scopes
| Scope | Gives |
|---|---|
account:read | /v1/me, /v1/usage |
calendar:read | the economic calendar |
news:read | news stories and sources |
strata:read | the liquidation model and recorded liquidations |
market:read | venues, markets, candles, open interest, funding, basis, long/short, large trades, order-book heatmap, footprint bars, ETF flows |
analytics:read | aggregated flow, OI build, stacked imbalances, screener, TWAP, market-cap indexes |
webhooks:write | managing your webhook endpoints |
#Rotating and revoking
- Rotate makes a new key with the same settings and stops the old one at once: put the new key in place straight after.
- Revoke stops a key for good. A revoked key answers
401 unauthorized, an expired one401 key_expired, and a call from outside the allow list403 ip_not_allowed; an open stream closes with4010.
#If a key leaks
Revoke it at once and make a new one. A key sent in a URL (?key=...) is refused and should be treated as leaked: URLs end up in logs.