Skip to main content

API keys

LiveLast verified 4 Nov 2026

An API key is a secret token, created in Settings, API Key, that lets your code call the Catapult API as you.

Create a key​

You create a key in the app and give it a name of up to 40 characters, for example "Trading bot". Store the key in a password manager or a secret store.

Settings, API Key tab: the API Keys title, the Create API Key button, the keys-used counter and the Explore Docs banner
The key is shown once

The app keeps no copy of the key you can display again. If you lose it, revoke it and create a new one.

Rules​

  • You can have up to 20 active keys at a time.
  • A key is valid for 730 days. After that, requests fail with UNAUTHENTICATED.
  • Revoking a key stops it immediately. It cannot be restored.
  • Every key acts as your account: the same balance, positions and tokens you see in the app.

What a key cannot do​

  • Withdraw, deposit, swap or transfer funds.
  • Trade 10000x Futures or play in the Trading Competition.
  • Change your email, 2FA, sessions or profile.
  • Create, list or revoke API keys. That is only possible in Settings.

A key can still spend your balance: it opens positions, creates tokens and buys boosters. Keep it as secret as your password.

Keep a key safe​

  • Load it from an environment variable or a secret manager. Never commit it or ship it in code that runs in a browser.
  • Use one key per bot, named after it, so you can revoke one without stopping the others.
  • If a key's last-used time shows activity you don't recognise, revoke the key and create a new one.

Use the key​

Send it as Authorization: Bearer <key> on HTTP requests, and in the connection_init message on the WebSocket. Details and examples: Authentication in the API docs. To let a third-party bot use your key without pasting it, see API key OAuth.