Skip to main content
POST
Create maker API key

Authorizations

Authorization
string
header
required

Wallet session: the access_token from POST /v1/auth/wallet-sessions, for a user who brings their own wallet to a partner's web page. It acts for that wallet's account with no scope limit, and is bound to the Origin it signed in from: send exactly one Origin header with that value, or the request is ORIGIN_REQUIRED or UNAUTHENTICATED. It lasts at most 30 days and ends after 7 idle days or at DELETE /v1/auth/wallet-sessions/current.

Headers

Idempotency-Key
string<uuid>
required

Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns 409 IDEMPOTENCY_KEY_REUSED.

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

Path Parameters

maker_id
string<uint64-decimal>
required

On-chain maker ID, as a decimal string. The credential must be authorized for this maker. Never 0.

Maximum string length: 20
Pattern: ^(0|[1-9][0-9]{0,18}|1[0-7][0-9]{18}|18[0-3][0-9]{17}|184[0-3][0-9]{16}|1844[0-5][0-9]{15}|18446[0-6][0-9]{14}|184467[0-3][0-9]{13}|1844674[0-3][0-9]{12}|184467440[0-6][0-9]{10}|1844674407[0-2][0-9]{9}|18446744073[0-6][0-9]{8}|1844674407370[0-8][0-9]{6}|18446744073709[0-4][0-9]{5}|184467440737095[0-4][0-9]{4}|18446744073709550[0-9]{3}|18446744073709551[0-5][0-9]{2}|1844674407370955160[0-9]|1844674407370955161[0-5])$

Body

application/json

The same shape for a personal account and a maker. proof is the owner's signature over the issue_key challenge for exactly this request without proof.

label
string
required

Your name for the key, 1 to 80 characters.

Required string length: 1 - 80
scopes
enum<string>[]
required

Permissions the key holds; each must apply to the account, as the capabilities route lists.

Required array length: 1 - 32 elements

One permission a key can hold. Each operation lists the scopes it requires, and a key holds only scopes that apply to its account, as the capabilities routes list. operations:read is reserved and never issued; maker:access:read is no longer issued and has no effect on a key that still carries it.

Available options:
identity:read,
account:read,
account:stream,
rfq:read,
rfq:write,
quote:write,
quote:read,
replay:read,
vault:read,
vault:write,
quote:accept,
position:cashout,
funding:deposit,
funding:withdraw,
sponsorship:use,
maker:access:read,
operations:read,
operations:submit
proof
object
required

The account owner's signature over the challenge for exactly this request without proof.

expires_in_days
integer
default:30

Lifetime in days, 1 to 90, or 0 for no expiry; 30 when omitted.

Required range: 0 <= x <= 90

Response

The new key and its secret, shown only in this response.

key
object
required

The new key's metadata.

secret
string
required

The ttk_ secret, shown only in this response; a retry of the same request answers SECRET_UNAVAILABLE, so store it now.

Pattern: ^ttk_v1_(dev|stg|prd)_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.[A-Za-z0-9_-]{43}$