Authentication and keys

One key for your scripts, kept out of the browser.

An API key lets your own program read prices and history from the Cloud9Trader API, and, with its secret, use the private WebSocket to see your account and send orders.

Create a key

1. Open API Access from the user menu.
2. Under Generate a key, type a label that says where the key will be used, such as “price script”, and click Generate new key.
3. Copy the key and the secret straight away. The secret is shown once and cannot be shown again.

Labels must be unique on your account. You can have as many keys as you need: one per program makes it easy to revoke just one.

Use a key

• REST API: send the key in the x-c9t-key header. The secret is not needed.
• Private WebSocket: sign the connection with the key and secret, as described in Private WebSocket. The private socket refuses connections from a web browser, so a secret never has to sit in a web page.

A request without a key gets 401 and “‘x-c9t-key’ is a required header”. A wrong key gets 401 and “API Key is incorrect”.

Keep keys safe

• Keep the secret on a server or your own machine, in an environment variable or a secret store. Never put it in a web page, a public repository or a shared algorithm.
• Keys do not expire and cannot be limited to certain actions, so revoke any key you no longer use.
• If a key or secret may have leaked, revoke it and create a new one.

Revoke a key

Under Your access keys, click Revoke next to the key. New requests with it are refused within a few seconds. A WebSocket connection already open with the key is not closed for you, so stop the program that opened it.

Usage

API Usage on the same screen shows how much of your 24-hour and 30-day credit allowances you have used. Costs and limits are in Plans and credits.

Read next

• REST API reference: endpoints, costs and responses.