Authentication

API keys, header format, key rotation, and scoping.

All v2 endpoints authenticate with a bearer API key tied to one portfolio account:

Authorization: Bearer pa_<64 hex characters>

• Keys are created in the dashboard and shown exactly once; only a SHA-256 hash is stored.
• Up to 5 keys per account — rotate by creating a new key, migrating, then revoking the old one (revocation is immediate).
• A key is scoped to its account: it can trade and read that account's portfolio, nothing else.
• Keys identify the executing bot on order records (apiKeyHash), so you can attribute fills per key.