> ## Documentation Index
> Fetch the complete documentation index at: https://docs.magicmarkets.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys: creating one, sending it on REST and on the WebSocket, what a key can and cannot do, and key hygiene.

Every request is authenticated with an API key. The public API has no other authentication method.

## Creating a key

API access needs a minimum deposit of 10 USDT on your account.

1. Sign in at [magicmarkets.com](https://magicmarkets.com).
2. Go to **Settings**, then **API**.
3. Click **Add API Key** and give it a name.
4. Copy the value. It is shown **once at creation**.

You can rename or revoke keys from the same page. There is no endpoint in the API to manage keys. The website limits the number of keys on each account.

## Sending the key

<Tabs>
  <Tab title="REST">
    Send the key in the `X-Api-Key` header on every request.

    ```bash theme={"dark"}
    curl https://magicmarkets.com/v2/balance/ \
      -H "X-Api-Key: $MAGICMARKETS_API_KEY"
    ```
  </Tab>

  <Tab title="WebSocket">
    A handshake cannot carry a header, so the key goes in the query string.

    ```
    wss://magicmarkets.com/v2/stream?api_key=<key>
    ```

    Authentication is enforced at the HTTP upgrade. A refused handshake returns a non-101 status with a short plain-text body: `400 missing_credentials` when `api_key` is absent, and `401 auth_rejected` when the key is not accepted. Many client libraries report this only as a generic handshake error, so **verify the key over REST first**.
  </Tab>
</Tabs>

## What a key can do

A key can read balance, positions, orders and betslips; create betslips; place and close orders; and manage heartbeats.

## What a key cannot do

The public API has no endpoint to deposit, withdraw, change a withdrawal address, or create, list or revoke API keys. All of that happens on the website behind your sign-in and two-step verification. A key that leaks can trade your balance. It cannot take it out of your account. See [Security](/traders/account/security) for sign-in and two-step verification.

## Rate limits are per account

All of an account's keys draw from one budget. A runaway script on one key throttles the others. See [Errors and rate limits](/developers/errors-and-rate-limits).

## Key hygiene

* Keep the key in an environment variable or a secret store. Never commit it, paste it into a chat, or put it in a screenshot.
* Use one key per program, so you can revoke one without stopping the rest.
* Revoke keys you no longer use.
* If a key leaks, revoke it on the website first, then check your open orders and positions.

## Errors

| HTTP | `code` | Meaning |
| - | - | - |
| 401 | `auth_error` | The server did not accept a key. Check the header name and the key value |
| 403 | `forbidden` | Valid key, action not allowed for this account |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.