Sign in
API Tokens

Derive scoped API token

Creates a new scoped API token for the authenticated partner. Requires Privy authentication (Bearer token). The token secret is returned once at creation — store it securely. Requested scopes must be a subset of the partner's allowed scopes.

post/auth/api-tokens/derive

Request body

labelstring

Human-readable label for the token

scopesstring[]

Scopes to grant. Defaults to ["trading"] if omitted. Must be a subset of the partner's allowed scopes. delegated_signing requires trading.

Example request

{
  "label": "production-trading-bot",
  "scopes": [
    "trading",
    "account_creation"
  ]
}

Response

Token created successfully. The secret is only returned once.

apiKeystring required

The token ID, used as the lmts-api-key header value for HMAC requests

secretstring required

Base64-encoded secret for HMAC signing. Returned once — store securely.

tokenIdstring required

Same as apiKey. The unique token identifier.

createdAtstring date-time required

Token creation timestamp

scopesstring[] required

Granted scopes

Example response

{
  "apiKey": "dGVzdC10b2tlbi0x",
  "secret": "c2VjcmV0LWtleS1leGFtcGxlLWJhc2U2NC1lbmNvZGVk",
  "tokenId": "dGVzdC10b2tlbi0x",
  "scopes": [
    "trading",
    "account_creation"
  ],
  "profile": {
    "id": 42,
    "account": "0x27b4afBD88fE7c88c6897BB0b4ADE338D0401E37"
  }
}

Changes

Changed in 4 of the 32 revisions of this API.14