API Keys
Access the TokenBot REST API with workspace-scoped API keys for programmatic integrations.
Overview
Section titled “Overview”The TokenBot REST API allows you to interact with the platform programmatically. API keys are scoped to a specific organization (workspace), ensuring isolation between different workspaces.
Creating an API Key
Section titled “Creating an API Key”tokenbot apikey create --name "analytics integration" --env liveThe secret is printed exactly once. Capture it there and then — it cannot be retrieved later.
--env accepts live or test and defaults to live. --permissions takes a comma-separated
list; run tokenbot apikey create --help for the values your account accepts.
tokenbot apikey list # active keys, without secretstokenbot apikey revoke <id>These keys are for your own integrations against the REST and GraphQL APIs. The CLI itself does not use them — it signs requests with the identity keypair from
tokenbot init.
Key Scoping
Section titled “Key Scoping”| Scope | Description |
|---|---|
| Organization | Each key belongs to one organization and can only access its resources |
| Permissions | Read-only, trade, or full management access |
| Rate Limits | Per-key rate limiting to prevent abuse |
Permissions
Section titled “Permissions”| Permission | Access |
|---|---|
| Read | View accounts, strategies, trades, balances |
| Trade | Execute trades, manage copiers |
| Manage | Create/delete strategies, manage exchange accounts |
Security Best Practices
Section titled “Security Best Practices”- Never share API keys or commit them to version control
- Use minimal permissions — only grant what’s needed
- Rotate keys regularly — delete old keys and create new ones
- Monitor usage — check API key activity logs
REST API vs GraphQL API
Section titled “REST API vs GraphQL API”| REST API | GraphQL API | |
|---|---|---|
| Auth | API keys | NextAuth sessions |
| Use Case | External integrations, bots | Frontend dashboards |
| Scope | Organization | User session |
| Access | Programmatic | Browser-based |
The REST API is the external developer API. The GraphQL API (AWS AppSync) powers all TokenBot frontend applications and is not intended for direct external use.
Rate Limits
Section titled “Rate Limits”API keys are rate-limited to ensure fair usage. Current limits are displayed in your API key management page. Exceeding limits returns 429 Too Many Requests.