Create an API key. The secret is returned once. A trade key needs an Ed25519 public key and a wallet-signed trade-key authorisation.
POST /api/v1/me/api-keys. Create an API key. The secret is returned once. A trade key needs an Ed25519 public key and a wallet-signed trade-key authorisation.
Request
POST /api/v1/me/api-keys
Authentication is required. Supported credentials: a signed-in customer session token in Authorization: Bearer …. This route does not accept customer API keys.
Parameters
| Name | In | Type | Required | Constraints | Description |
|---|---|---|---|---|---|
X-Service-Act-As | header | string | No | min length: 3; max length: 512 | Service-principal path only (local and devnet stages; refused by configuration on mainnet). With an OAuth client-credentials bearer token from the validator, names the allow-listed Party the client acts as. Missing: 400 SERVICE_ACT_AS_REQUIRED; not allow-listed: 403 SERVICE_PARTY_NOT_ALLOWED. Ignored for customer session tokens. |
X-Request-Id | header | string | No | min length: 8; max length: 128; pattern: ^[A-Za-z0-9._:-]+$ | Optional client correlation identifier. The server always generates a separate authoritative request ID and retains a valid supplied value only as secondary audit correlation metadata. |
Request body
A body is required.
Content type: application/json
Type: object.
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
name | string | Yes | min length: 1; max length: 64 | — |
scopes | one or more variants · Schema 1 | Yes | — | — |
signingPublicKey | string | No | min length: 43; max length: 88 | — |
authorization | object · Schema 2 | No | — | — |
ipAllowlist | array of string · Schema 3 | Yes | max items: 16; default: [] | — |
expiresInDays | integer | No | minimum: 1; maximum: 365 | — |
Additional fields are not allowed.
cURL
Create request.json using the request-body schema. The example sends the file bytes unchanged.
curl --fail-with-body --silent --show-error \
--request POST \
--url "https://launch-api.supanova.app/api/v1/me/api-keys" \
--header "Authorization: Bearer $SUPANOVA_SESSION_TOKEN" \
--header "Content-Type: application/json" \
--data-binary @request.jsonResponses
201
The key and its one-time secret.
| Header | Type | Description |
|---|---|---|
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Type: object.
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
key | object · Schema 4 | Yes | — | — |
secret | string | Yes | pattern: ^sn_(live|test)_[a-z2-7]{12}_[A-Za-z0-9_-]{43}$ | — |
Additional fields are not allowed.
400
The request is malformed or failed validation. Codes: VALIDATION_FAILED, AMBIGUOUS_CREDENTIALS, SERVICE_ACT_AS_REQUIRED.
| Header | Type | Description |
|---|---|---|
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Standard envelope: error.code, error.message, optional error.details, and requestId. See error handling and the full code registry.
401
Not signed in. Also: AUTHENTICATION_REQUIRED, INVALID_AUTHORIZATION_HEADER, INVALID_ACCESS_TOKEN, SESSION_REVOKED.
| Header | Type | Description |
|---|---|---|
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Standard envelope: error.code, error.message, optional error.details, and requestId. See error handling and the full code registry.
403
Not an interactive session, or a restricted account. Also: ACCOUNT_RESTRICTED, ANONYMOUS_ACCOUNT_NOT_ALLOWED, API_KEY_ROUTE_NOT_ALLOWED, SERVICE_PARTY_NOT_ALLOWED, SERVICE_PRINCIPAL_NOT_ALLOWED, SIGNUP_NOT_INVITED, INTERACTIVE_SESSION_REQUIRED.
| Header | Type | Description |
|---|---|---|
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Standard envelope: error.code, error.message, optional error.details, and requestId. See error handling and the full code registry.
409
The per-account key limit is reached.
| Header | Type | Description |
|---|---|---|
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Standard envelope: error.code, error.message, optional error.details, and requestId. See error handling and the full code registry.
413
The request body exceeds the size limit.
| Header | Type | Description |
|---|---|---|
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Standard envelope: error.code, error.message, optional error.details, and requestId. See error handling and the full code registry.
428
The signed-in account must accept the current product terms first. Codes: PRODUCT_LEGAL_ACCEPTANCE_REQUIRED.
| Header | Type | Description |
|---|---|---|
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Standard envelope: error.code, error.message, optional error.details, and requestId. See error handling and the full code registry.
429
The caller exceeded an IP or principal request budget.
| Header | Type | Description |
|---|---|---|
Retry-After | integer | Whole seconds to wait before retrying a rate-limited request. |
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Standard envelope: error.code, error.message, optional error.details, and requestId. See error handling and the full code registry.
503
A dependency is unavailable or the feature is not enabled on this deployment. Codes: AUTHENTICATION_UNAVAILABLE, AUTHORIZATION_UNAVAILABLE.
| Header | Type | Description |
|---|---|---|
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Standard envelope: error.code, error.message, optional error.details, and requestId. See error handling and the full code registry.
default
Machine-readable API error. The HTTP status identifies the error class.
| Header | Type | Description |
|---|---|---|
X-Request-Id | string | Server-generated request correlation identifier to retain for support and reconciliation. |
Content type: application/json
Standard envelope: error.code, error.message, optional error.details, and requestId. See error handling and the full code registry.
Nested schemas
Field links above lead to the complete nested object, array, and variant definitions below. Required fields are scoped to their containing object.
Schema 1
Request body.scopes
Type: one or more variants.
At least one of these variants must match:
- Variant 1: array of unspecified · Schema 5. min items:
1; max items:1 - Variant 2: array of unspecified · Schema 6. min items:
2; max items:2
Schema 2
Request body.authorization
Type: object.
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
challengeId | string | Yes | format: uuid; pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ | — |
message | string | Yes | min length: 1; max length: 4096 | — |
signature | string | Yes | min length: 1; max length: 512 | — |
publicKey | string | Yes | min length: 1; max length: 128 | — |
Additional fields are not allowed.
Schema 3
Request body.ipAllowlist
Type: array of string.
max items: 16; default: []
Array items: string. max length: 64
Schema 4
Response 201.key
Type: object.
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
id | string | Yes | pattern: ^[a-z2-7]{12}$ | — |
name | string | Yes | — | — |
environment | string | Yes | allowed: "live", "test" | — |
scopes | array of string · Schema 7 | Yes | — | — |
signed | boolean | Yes | — | — |
authorizedParty | string or null | Yes | — | — |
ipAllowlist | array of string · Schema 8 | Yes | — | — |
expiresAt | one or more variants · Schema 9 | Yes | — | — |
createdAt | string | Yes | format: date-time; pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ | — |
lastUsedAt | one or more variants · Schema 9 | Yes | — | — |
revokedAt | one or more variants · Schema 9 | Yes | — | — |
status | string | Yes | allowed: "active", "expired", "revoked" | — |
Additional fields are not allowed.
Schema 5
Request body.scopes variant 1
Type: array of unspecified.
min items: 1; max items: 1
Tuple positions (in order):
"read".
Schema 6
Request body.scopes variant 2
Type: array of unspecified.
min items: 2; max items: 2
Tuple positions (in order):
"read"."trade".
Schema 7
Response 201.key.scopes
Type: array of string.
Array items: string. allowed: "read", "trade", "withdraw"
Schema 8
Response 201.key.ipAllowlist
Type: array of string.
Array items: string.
Schema 9
Response 201.key.expiresAt
Type: one or more variants.
At least one of these variants must match:
- Variant 1: string. format:
date-time; pattern:^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ - Variant 2: null.
Source contract
This page is generated from the checked-in customer OpenAPI snapshot. Download JSON, download YAML, or compare the live API reference. Snapshot provenance records the retrieval date and checksum.