Authentication
API keys, scopes, and acting for a team.
Send your key as a bearer token on every request:
curl https://api.orderfill.trade/v1/accounts \
-H "authorization: Bearer $ORDERFILL_API_KEY"Keys look like of_live_3f8a2b19_kZ…. The part after of_live_ up to the next _ is
the key's prefix, which is what the dashboard shows so you can tell keys apart.
Scopes
| Scope | Can do |
|---|---|
read | See accounts, balances, positions, orders and symbols. |
trade | Everything read can, plus trade, connect and disconnect accounts, and pin symbols. |
Give a bot or an agent the smallest scope it needs. A read key that leaks cannot
move money.
Your first key
The first key comes from the dashboard: sign up, open API keys, create one. After that everything is possible through the API alone, including connecting accounts with their login, password and server.
What a key cannot do
A key can do anything a signed-in person can, except create or revoke keys. That stays in the dashboard, so a leaked key cannot mint itself a more powerful one.
Keys belong to your team
A key acts for the team it was created in, with its creator's current role. Remove
someone from the team and the keys they made lose access with them. A viewer can
hold a key, and that key can read but never trade.
Acting for another team
If you belong to more than one team and sign in as a person rather than with a key, choose the team per request:
X-Org-Id: 7d0c…Without it you act in your personal team. If you are not a member of the team you
name, the request is refused with 403. Keys ignore this header; they always act for
their own team.
Keeping keys safe
We store a hash of each key, not the key, so we cannot show it to you again. If you lose one, revoke it and create another. Never put a key in browser code or a public repository; for a browser, sign in and use the dashboard session instead.