API keys

Authenticate API requests with your key.

Authentication: one API key

Use your API key to authenticate API requests.

# HTTP
curl https://api.pmwallets.com/v1/account/fills?limit=100 -H "Authorization: Bearer $PMW_KEY"

# WebSocket — the handshake cannot set Authorization, so the key goes in its own header
const ws = new WebSocket("wss://api.pmwallets.com/v1/ws", { headers: { "x-api-key": process.env.PMW_KEY } });

Both headers work: Authorization: Bearer and x-api-key. Use the second for a WebSocket handshake that cannot set Authorization. The same key works for both transports.

Create and revoke them on the API keys page. The key is shown only in the creation response: we keep only a hash, so it cannot be recovered, only replaced. Up to 5 active keys allow rotation without downtime (issue the new one, move traffic across, revoke the old), and a revocation takes effect immediately.

A request carrying a key needs no Origin header. If a key is present at all it is the only credential we read. On the account endpoints (everything under /v1/account, and the WebSocket) a key that is unknown or revoked is a 401, with no fallback to the cookie. The public reads, /v1/leaderboard, /v1/periods, /v1/markets, treat a key that does not resolve as no key: a 200 with the anonymous 20-row sample and tier: "anon". If you sent a key and see that tier, the key is wrong.

API keys are not used for receiving webhooks. We are calling you, and you verify the signature with the secret you were given when you registered the endpoint. Use this secret to verify the sender.