---
title: "Set the on-chain allowances the venue needs"
method: POST
path: "/exchanges/{exchange_id}/allowances"
tags: ["Exchanges"]
---

# Set the on-chain allowances the venue needs

`POST /exchanges/{exchange_id}/allowances`

## Request

- Base URL: `https://execution.kairos.trade`
- URL: `https://execution.kairos.trade/exchanges/{exchange_id}/allowances`
- Auth: API key in header `X-Client-Id` and API key in header `X-Api-Key` and API key in header `X-Api-Secret`

Grants the venue's contracts the token approvals they need, signed custodially with your delegated key. Idempotent in effect: an already-sufficient allowance is not re-sent, and the corresponding `*_tx_hash` comes back `null`.
The three identity fields in the body are required by the schema but are validated against the authenticated caller — they can confirm authority, never grant it. A mismatch, or a wallet you do not own, is a `403`.
Self-custody callers on the external-signing lane should use `POST /v2/onchain/intent` with `op: "approvals"` instead, and sign the approvals themselves.
**Auth & scope.** Requires `trade:execute`, the mutation gate (API-key triple satisfies it), and a current Turnkey policy version.

## Path parameters

- `exchange_id` string, required

## Request body

- OrderSetAllowancesRequest: Body for `POST /exchanges/{exchange_id}/allowances`. All three identity fields are required by the schema but are VALIDATED against the authenticated caller, never trusted — they can confirm authority, never grant it.
  - `user_id` string, required
  - `turnkey_org_id` string, required
  - `wallet_address` string, required

## Response `200`

Approvals submitted (or already sufficient).

- OrderSetAllowancesResponse
  - `usdc_tx_hash` string, nullable
  - `ctf_tx_hash` string, nullable
  - `success` boolean, required

## Other responses

- `401`: No valid credential presented — missing/invalid API-key headers or an invalid/expired session token.
- `403`: Missing `trade:execute` scope, API-key access to this provider disabled, an identity field that does not match the authenticated caller (`AUTH_IDENTITY_MISMATCH`), a wallet you do not own, or installed Turnkey policies behind the required version (`AUTH_POLICY_OUTDATED`).
- `404`: No allowance manager registered for this venue.
- `500`: Credentials or signing authority could not be resolved, or a non-retryable approval submission failed. Submission failures return `ALLOWANCE_APPROVAL_FAILED` without exposing signer or custody internals.
- `502`: An upstream approval dependency failed. Returns `ALLOWANCE_APPROVAL_FAILED`; re-read allowance state before retrying.
- `503`: Approval submission is temporarily busy, or API-key access to this provider could not be checked (fails closed).
- `504`: Approval submission or confirmation timed out. Returns `ALLOWANCE_APPROVAL_FAILED`; re-read allowance state because the transaction may have landed.

---

[API](https://skmtc.dev/kairos/apis/kairos-order-execution-api.md) - [All operations](https://skmtc.dev/kairos/apis/kairos-order-execution-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kairos/apis/kairos-order-execution-api/revisions/9ba7d463d505?raw)