---
title: "Connect your own Kalshi account by storing its API credentials"
method: POST
path: "/exchanges/kalshi/enable-trading"
tags: ["Onboarding"]
---

# Connect your own Kalshi account by storing its API credentials

`POST /exchanges/kalshi/enable-trading`

## Request

- Base URL: `https://execution.kairos.trade`
- URL: `https://execution.kairos.trade/exchanges/kalshi/enable-trading`
- Auth: API key in header `X-Client-Id` and API key in header `X-Api-Key` and API key in header `X-Api-Secret`

Kalshi is the one venue where Kairos does NOT custody or provision an identity — you trade against your own Kalshi account, so you supply your own Kalshi API key and RSA private key here. The server validates the PEM, proves the credentials work by calling Kalshi's balance endpoint, then encrypts them (AES-256-GCM) and stores them.
**You are handing over a live private key.** It is stored encrypted and used only to sign Kalshi requests on your behalf. Rotate it at Kalshi and re-run this endpoint to replace it.
Both PKCS#1 and PKCS#8 PEM encodings are accepted, and a key pasted as a single line with literal `\n` escapes is normalized before parsing.
`POST /exchanges/kalshi_offchain/enable-trading` is a deprecated alias of this route, kept for clients that are not deployed in lockstep.
> **Error shape.** Minimal `{"error": "...", "code": "..."}` (`OrderSimpleErrorResponse`), not the structured envelope.
**Auth & scope.** Requires `trade:execute` for `kalshi` and the mutation gate.

## Request body

- OrderKalshiEnableTradingRequest: Body for `POST /exchanges/kalshi/enable-trading`. Kalshi trades against the user's OWN Kalshi account, so the caller supplies their own Kalshi API credentials — Kairos does not provision them.
  - `api_key_id` string, required: Kalshi API Key ID (the public identifier). Must be non-blank.
  - `private_key_pem` string, required: The matching RSA private key, PEM-encoded. Both PKCS#1 (`BEGIN RSA PRIVATE KEY`) and PKCS#8 (`BEGIN PRIVATE KEY`) are accepted, and a key pasted as a single line with literal `\n` escape sequences is normalized server-side.

## Response `200`

Credentials validated against Kalshi and stored.

- OrderKalshiEnableTradingResponse
  - `success` boolean, required
  - `message` string, required

## Other responses

- `400`: `INVALID_USER_ID`; `MISSING_API_KEY_ID` ("API Key ID is required"); `INVALID_PRIVATE_KEY` ("Invalid RSA private key. Must be a valid PEM-encoded RSA key."); or `INVALID_CREDENTIALS` — the key parsed but Kalshi rejected it.
- `401`: No valid credential presented — missing/invalid API-key headers or an invalid/expired session token.
- `403`: `INSUFFICIENT_SCOPE` or `PLATFORM_API_ACCESS_DISABLED`.
- `500`: `CONFIG_ERROR` ("Internal configuration error" / "Encryption configuration error"), `ENCRYPTION_ERROR` ("Failed to encrypt credentials"), or `DB_ERROR` ("Failed to save credentials").

---

[API](https://skmtc.dev/kairos/apis/kairos-order-execution-api.md) - [All operations](https://skmtc.dev/kairos/apis/kairos-order-execution-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kairos/apis/kairos-order-execution-api/revisions/9ba7d463d505?raw)