Authentication

Send your key in the Authorization header as a bearer token on every request except GET /health and GET /openapi.json.

Keys start with enton_live_ or enton_test_ followed by 64 hexadecimal characters. Create and revoke them in the developer portal. The full key is shown once, when you create it; after that the portal shows only its first characters.

Every request needs an active Trader or Partner plan on the account that owns the key. A trial counts. Without one, requests get 401 with Active subscription required. A free account can create one key, but the key is refused until the account has a plan.

A key keeps the limits of the plan the account had when the key was created. After you change plan, create a new key to get the new limits. How the limits are counted is on the errors and rate limits page.

You choose a key's environment when you create it, and it shows in the key's prefix.

• enton_live_ keys can do everything their scopes allow, including placing real orders.
• enton_test_ keys are refused by trade execution with 403. Every other endpoint behaves the same for both, against live data.

A key carries the scopes you picked when you created it. A key created without picking any gets *, which allows every endpoint. A request to an endpoint whose scope the key lacks gets 403 with Insufficient permissions. Required scope: ….

GET /discover, which lists discovery providers, needs a valid key but checks no scope.

• Call the API from your server. Never put a key in a web page, a mobile app or a public repository.
• Give each integration its own key with only the scopes it needs, so you can revoke one without breaking the others.
• If a key leaks, revoke it in the developer portal and create a new one. Revoked keys get 401 at once.