Trademetrytrademetry

API keys

Programmatic access, scoped to the permissions you choose.

An API key lets a script, an integration, or an agent talk to Trademetry without a browser session. Keys live under Settings → API Keys and carry their own permissions, independent of any person's role.

Create a key

  1. Choose Create Key

    From the API Keys tab.

  2. Name it

    For you, not for the system. Name it after the thing that will use it, so revoking the right one later is obvious.

  3. Set an expiry (optional)

    A key with no expiry works until it is deleted.

  4. Choose permissions

    Start from a preset, then adjust. The presets are Full Access, Read Only, Trade Management, Billing & Invoices, CRM Only, and Monitoring.

  5. Copy the key

    It is shown once, at creation, and never again.

The full key is displayed exactly once. Trademetry stores only a hash of it, so there is no "show me that key again" — a lost key is replaced, not recovered. Put it straight into wherever it belongs.

The list

Each key shows its Name, a Prefix (the visible first characters, enough to identify which key a log line refers to without exposing the secret), Permissions, Module scope, Last used, and Expires.

Last used is the column to check before deleting anything. A key nothing has touched in months is a key nothing depends on.

Scoping

Give a key the least it needs. Presets make the common shapes quick:

  • Monitoring — view accounts, trades, notifications, and performance. Correct for a dashboard or an alerting script.
  • Trade Management — view, create, and update accounts and copiers, and view trades. Correct for provisioning automation.
  • Read Only — view on everything.
  • Full Access — everything. Worth avoiding unless you genuinely need it, because a leaked full-access key can delete accounts.

Keys are the right way to grant an integration access. Sharing a person's login is not: it inherits their whole role, cannot be scoped down, and revoking it locks a human out.

Revoking

Delete the key. It stops working immediately, and anything using it starts failing authentication — which is the point, but check Last used first so you know what you are about to break.