Docs
Authentication
Bearer tokens, key prefixes, scopes, rotation. No cookies, no OAuth dance for server-to-server calls.
Bearer tokens
Pass the secret in the Authorization header. Treat keys like passwords — never embed them in client-side code.
Authorization: Bearer ck_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Key prefixes
ck_live_ — production traffic, hits production rate-limits and quota.
ck_sbox_ — sandbox traffic, free, returns deterministic sample payloads. Use during development and CI.
Scopes
Keys carry a list of scopes. Minimum required scopes are noted on each endpoint reference page.
read:master — read master-data endpoints (HSN, ports, scheme codes, …).
read:events — read trade-event streams.
write:ai — invoke AI endpoints (consumes AI credits).
admin — manage subscriptions, keys, members (requires admin role).
Rotation
Revoke any key from Dashboard → API Keys. Active sessions are terminated within 60 seconds globally.