API Keys

Issue and revoke hashed API keys for programmatic access to your strategies and instances.

Two Key Scopes

RocketX supports two scopes of API keys, both stored as SHA-256 hashes — the raw key is only shown once at creation time.

Scope	Format	Bound to
Team-scoped	`sk_live_...`	A specific team; permissions are enumerated explicitly
User-scoped	`sk_live_...`	The user's identity across all their teams

Generating a Key

Go to Settings → API Keys (or Settings → My API Keys for personal keys).
Click New API Key, give it a name, and select the desired permissions.
Copy the key immediately — it is not stored in plain text and cannot be retrieved again.

Using a Key

Include the key in the Authorization header:

curl https://api.yourdomain.com/v1/developer/strategies \
  -H "Authorization: Bearer sk_live_your_key_here"

The API verifies keys using timing-safe comparison and records lastUsedAt non-blocking on every hit.

Permissions

Team-scoped keys carry an explicit permission list. Available permissions include:

team:read — read team metadata
team:update — update team settings
team:manage_members — invite and remove members
api_keys:read / api_keys:write — manage API keys programmatically

User-scoped keys inherit the user's membership permissions for whichever team the request targets (resolved from the team slug or header).

Revocation

Keys can be deleted at any time by the team owner from the API Keys settings page. Deletion is immediate — all subsequent requests using that key return 401.

API Reference

For the full list of endpoints, visit the API Docs.