API Key Management

API keys are cryptographic credentials that authenticate your application when making requests to the Zodia Markets REST and WebSocket APIs. This guide explains how to generate, configure, and secure your API keys.

Understanding API Keys

Key Components

Each API key consists of two parts:

Component	Description	Usage
API Key	Public identifier (like a username)	Included in every API request header
API Secret	Private credential (like a password)	Used to sign requests; never transmitte

Generating API Keys

Step 1: Access API Settings on Zodia Markets Customer Portal

Log in to your account on the Zodia Markets Customer Portal
Click on your profile icon in the top-right corner
Select SETTINGS from the dropdown menu

Step 2: Navigate to API Keys

In the Settings page, click the API Keys tab
Click Create New API Key

📱
Two-Factor Authentication
If 2FA is enabled on your account (recommended), you'll be prompted to enter your One-Time Password (OTP) before proceeding.

Step 3: Confirm Signed Intent

For customers requiring the highest level of security and non-repudiation, Zodia Markets supports cryptographically signed orders using RSA key pairs. This feature is optional and can be skipped when creating an API key.

See the Signed RSA Key page for full details on providing RSA key pairs on API key registration.

Step 4: Assign Permissions

API keys can be configured with different permission levels:

Permission	Description
Move Funds	Allows movement of balances between sub-accounts
Place and Manage Orders	Allows trade execution on the RFS Websocket

If both options are toggled off, these are considered to be read only keys.

Step 5: Save Your Credentials

Your API Key and API Secret will be displayed
Immediately copy and securely store both values
Click SAVE

⚠️
Critical: API Secret Is Shown Only Once
The API secret cannot be retrieved after you click SAVE. If you lose it:

Click the yellow refresh icon next to the key

A new secret will be generated

The old secret will be immediately disabled

Update your applications with the new secret to avoid service disruption.

Managing Multiple API Keys

You can create multiple API keys to:

Separate keys for different applications or environments
Implement different permission levels for different services
Rotate keys without service disruption
Isolate security boundaries between systems