Skip to main content
Every request to the key-scoped surface carries a bearer key:
Tenant keys are issued per commercial contract and resolve to your tenant principal on our side. They are server-to-server credentials. Never put one in a browser, a mobile app, or anything else an end user can inspect. If a key ships to a client once, assume it is public and ask for a revoke.

​
Browser access to market data

Market data routes can also admit browser requests from origins you register with us. This is how a chart in your web app reads history and quotes without your backend proxying every request. Two rules keep this safe:
  • only market data routes admit registered origins. Trading and account routes always require the key, from your server, with no exceptions;
  • if a request carries an Origin header, that origin must be on your allowlist even when a valid key is attached. A bearer excuses a missing origin, never an untrusted one.

​
Partner authentication

Partner keys use the same header and the same token shape, and they reach /api/partner/ only. Tenant keys are refused there. See Keys for the full permission model.