> ## Documentation Index
> Fetch the complete documentation index at: https://docs.totalis.trade/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API key

> Create an API key for your Totalis account. The full secret is returned only in this response, so save it immediately. Needs a Privy session or a key that holds keys:manage.

<Note>
  Every body field is optional:

  | Field | Meaning |
  | - | - |
  | `name` | A label for the key. |
  | `preset` | `read_only`, `trading` or `full`. With neither `preset` nor `scopes`, the key gets `trading`. |
  | `scopes` | An explicit scope list. Overrides `preset`. |
  | `confirm_withdraw` | Must be `true` for a key that would hold `funds:withdraw`. |

  No key can hold a scope its creator lacks. Keys created here never expire; revoke one to end it.
  An account can hold 10 active keys. The eleventh returns `409` with reason `api_key_limit`.
</Note>


## OpenAPI

````yaml POST /v1/api-keys
openapi: 3.0.3
info:
  title: Totalis RFQ API
  version: 2.1.0
  description: >-
    Public REST surface for the Totalis parlay RFQ platform, a decentralized
    request-for-quote marketplace for parlay bets across Kalshi and Polymarket,
    with on-chain Solana vault settlement.


    **Wire format**: snake_case JSON. All successful responses are wrapped in `{
    "data": ... }`; list endpoints add `meta` with cursor-based pagination.
    Errors use a `{ "error": { code, message, details? } }` envelope.


    **Authentication**: programmatic clients send `X-API-Key`; the web dashboard
    uses Privy JWTs (`Authorization: Bearer ...`). Any authenticated user can
    both place parlays and quote as a market maker. There is no separate MM
    role. Admin endpoints are out of scope for this public reference.


    **Rate limiting**: three buckets. Authenticated routes share one per-account
    bucket of 300 req/min (100 without a key). Public market reads (`/markets`,
    `/v1/markets`) are a separate per-IP bucket of 100 req/min that an API key
    does not raise. Quote service routes (`/v1/quote-requests`,
    `/v1/cashout-requests`, `/v1/mm/quote-requests`, `/v1/mm/cashout-requests`)
    have their own per-IP limit, 300 req/min by default. Responses include
    `X-RateLimit-*` headers. Request body limit: 256KB.


    **Pagination**: list endpoints use opaque cursor pagination. Pass
    `meta.cursor` from the previous response as `?cursor=...` to fetch the next
    page; do not parse or construct cursors client-side.
servers:
  - url: https://api.totalis.trade
    description: Production
security:
  - ApiKey: []
tags:
  - name: Markets
    description: Cached Kalshi and Polymarket market data.
  - name: User
    description: User profile, wallet, and devnet helpers.
  - name: API Keys
    description: Manage programmatic access keys for the authenticated user.
paths:
  /v1/api-keys:
    post:
      tags:
        - API Keys
      summary: Create API Key
      description: >-
        Create a new API key for the authenticated user. The full secret is
        returned **once** in `data.key`, so save it immediately. Subsequent
        listings only show the prefix. Requires a Privy JWT (web dashboard), or
        an API key holding the `keys:manage` scope.
      operationId: createApiKey
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: Optional display name for the key.
                preset:
                  type: string
                  enum:
                    - read_only
                    - trading
                    - full
                  description: >-
                    A scope bundle. With neither `preset` nor `scopes`, the key
                    gets `trading`.
                scopes:
                  type: array
                  items:
                    type: string
                  description: >-
                    An explicit scope list. Overrides `preset`. A key can never
                    hold a scope its creator lacks.
                confirm_withdraw:
                  type: boolean
                  description: >-
                    Required as `true` when the resulting key would hold
                    `funds:withdraw`.
      responses:
        '201':
          description: API key created (full key visible once)
          content:
            application/json:
              schema:
                type: object
                required:
                  - data
                properties:
                  data:
                    $ref: '#/components/schemas/ApiKeyFull'
        '401':
          $ref: '#/components/responses/Unauthorized'
      security:
        - PrivyJWT: []
        - ApiKey: []
components:
  schemas:
    ApiKeyFull:
      type: object
      description: Returned only on creation; the full `key` is visible exactly once.
      properties:
        key:
          type: string
          description: Full API key (only shown once).
        key_prefix:
          type: string
        name:
          type: string
        created_at:
          type: string
          format: date-time
        expires_at:
          type: string
          format: date-time
    ErrorEnvelope:
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/ErrorBody'
    ErrorBody:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
          enum:
            - VALIDATION_ERROR
            - UNAUTHORIZED
            - FORBIDDEN
            - NOT_FOUND
            - CONFLICT
            - RATE_LIMITED
            - PAYLOAD_TOO_LARGE
            - INTERNAL_ERROR
            - SERVICE_UNAVAILABLE
          description: Machine-readable error code.
        message:
          type: string
          description: Human-readable error message.
        details:
          type: object
          description: Additional error context.
        retry_after:
          type: integer
          nullable: true
          description: Seconds until retry; set on 429 responses.
  responses:
    Unauthorized:
      description: Missing or invalid authentication
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            error:
              code: UNAUTHORIZED
              message: Missing or invalid authentication
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: >-
        Programmatic API key. Sent as `X-API-Key: <key>`. Generate one from the
        Totalis dashboard. The WebSocket takes no header; send the key in the
        auth message instead.
    PrivyJWT:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Privy JWT issued to the web dashboard. Sent as `Authorization: Bearer
        <jwt>`. The Privy session signer underpins all wallet-signed actions.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.