> For the complete documentation index, see [llms.txt](https://docs.lighter.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lighter.xyz/developers/integration-guides/api-keys.md). # API keys {% hint style="info" %} **Lighter on Robinhood Chain** On RH, API key indexes 0–3 and 157 are reserved for Lighter's apps; use 4–156 or 158–254. See [Lighter on Robinhood Chain](/developers/robinhood-chain/overview.md) for everything that differs on RH. {% endhint %} You can use API keys to trade and manage your lighter account programmatically. Each API key will be assigned an index, ranging from 0 to 254 - note that indexes `{0,1,2,3}` are reserved for desktop and mobile interfaces. Each internal account, whether that's a master account or a sub-account, will have its own separate API key index - and each comes with a public & private key, and its own nonce. ## Permissions | Property | Value | | ----------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Scope | One account index (master, sub-account or pool) | | Index range | 0–254. **0–3 reserved** for Lighter's web/mobile apps. Use 4–254. | | Special index 255 | "All keys" – only for querying [apikeys](https://docs.lighter.xyz/api/api-keys) | | Nonce | Independent per key (see [Core concepts](/developers/getting-started/core-concepts.md#nonce)) | | Registration | `ChangePubKey`, requires the L1 wallet signature (or an on-chain call) | | Can do | Trade, cancel, modify, leverage/margin, sub-accounts, secure withdrawals, same-owner transfers, auth-gated REST and WebSocket reads | | Cannot do alone | Transfers to another L1 owner, fast withdrawals, approving an integrator with fees (these also need the L1 signature) | Secure withdrawals only need the API key because they can only go back to the L1 address that created the account. Fast withdrawals and transfers can go to other L1 addresses, so they also need a signature from the wallet's private key. See [When an L1 signature is required](/developers/reference/wasm-signer.md#when-an-l1-signature-is-required). List keys on an account: ```shell curl "https://mainnet.zklighter.elliot.ai/api/v1/apikeys?account_index=123&api_key_index=255" ``` ## Authentication To interact with certain endpoints, you will need to generate an auth token using your API private key. You can do so using our [GO SDK](https://github.com/elliottech/lighter-go), the create\_auth\_token\_with\_expiry() function in our [Python SDK](https://github.com/elliottech/lighter-python), or the WASM signer: ```typescript const deadline = Math.floor(Date.now() / 1000) + 3600; // unix seconds, max 8h ahead const { authToken } = check(lighter.CreateAuthToken(deadline, API_KEY_INDEX, ACCOUNT_INDEX)); ``` Each auth token can have a maximum expiry of 8 hours, and it uses the following structure: `{expiry_unix}:{account_index}:{api_key_index}:{random_hex}`. Refresh tokens before they expire. Use it as: * REST: `Authorization: ` header, or the `auth` query parameter where documented. * WebSocket: `"auth": ""` inside the subscribe message. Authenticating a request also makes it count against your L1 address instead of your IP. See [Rate Limits](/developers/reference/rate-limits.md). ## Read-only Authentication Using a canonical auth code, you can generate read-only auth tokens - those won't allow placing trades nor request withdrawals (essentially, you won't be able to sign transactions hence initialize a signer client), but you will be able to access auth-gated data via API. Each read-only auth code can have a maximum expiry of 10 years, and a minimum of 1 day. They will use the following structure: `ro:{account_index}:{single|all}:{expiry_unix}:{random_hex}`. `all` covers the master account and its sub-accounts; `single` covers one account index. You can generate one using the [createToken](https://docs.lighter.xyz/api/api-keys) endpoint, or [via front-end](https://app.lighter.xyz/read-only-tokens/). `tokens/create` is expensive: it costs **23,000** request weight, nearly a full minute of a Plus or Premium/Advanced budget. Create tokens once and store them; don't create one per session. {% hint style="success" %} **Read-only tokens for dashboards and AI agents** Giving a dashboard, tax tool or AI agent access to a user's Lighter data? Use a **read-only token**, not an API key. {% endhint %} ## Maker-only API keys Clients on a Premium/Advanced account may mark up to 251 keys per account index as maker-only. Those keys will be restricted to 0ms speed bump transactions only: * Post-only (ALO) orders * Modify orders on ALO orders * Cancel, and Cancel All orders The direct benefit of using this configuration is having access to an optimized execution path, with reduced scheduling latency. Keys reserved by our front-end (0-3) cannot be set as maker-only, and we apply a one-hour cooldown in between changes. You can set a list of keys as maker-only using [setMakerOnlyApiKeys](https://docs.lighter.xyz/api/api-keys), and get a list of maker-only keys using [getMakerOnlyApiKeys](https://docs.lighter.xyz/api/api-keys). ## How to create API keys programmatically While generating the API keys does not require your L1 private key, associating them with your Lighter account does. See [Create accounts programmatically](https://docs.lighter.xyz/developers/integration-guides/pages/d1q7WUTUJVmxIIgcv84o#id-2.-register-an-api-key) for a TypeScript example, or use the [Python SDK](https://github.com/elliottech/lighter-python/blob/main/examples/system_setup.py#L58) or the [GO SDK](https://github.com/elliottech/lighter-go/blob/0d4ddf155950e8ad62164a9d34a139750deebe37/README.md?plain=1#L26). You can also interact with Lighter's smart contract directly using the [ChangePubKey function](https://app.lighter.xyz/ethereum-gateway/) (this is particularly helpful if you're running a multi-sig). ## Nonce management Each API key has its own nonce. Nonce rules, skipping nonces, which rejected transactions consume a nonce, and why to use a separate API key per workload are covered in [Core concepts](/developers/getting-started/core-concepts.md#nonce). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.lighter.xyz/developers/integration-guides/api-keys.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.