Skip to main content
Send your API key in the HTTP Authorization header with the Bearer scheme:
API keys currently have one scope: full read and trading access to every challenge account owned by the Funding Perpetuals user who created the key. The API information and tradable-market catalog endpoints are public; account state, quotes, positions, and orders require a key.

​
Keep keys server-side

API keys are long-lived credentials. Store them in a secret manager or an encrypted environment registry. Do not commit a key, print it in logs, include it in a URL, or ship it in frontend code. Production keys begin with fp_live_. Keys created in development or preview deployments begin with fp_test_ and cannot authenticate against production because each environment has a separate credential database.

​
Rotate a key

Create a replacement key, update your client, confirm it can make an authenticated read, and then revoke the old key in API Key Settings. Revocation takes effect for new requests immediately; a request already in flight may still finish.