POST /keys

Create an API key

Create an API key.

operationId: createApiKey

Declared server: https://api.testnet.nexus.xyz/v1. See Networks.

Not reachable through CCXT. Session/credential lifecycle. CCXT takes credentials as constructor config; it never mints them.

Authentication: bearerAuth.

Create an API key

post

/keys

Create a new HMAC API key for the authenticated wallet. Returns the secret once — it is never stored or shown again. Requires a session token (Bearer) from POST /auth/login.

The host you call this on decides which network the key is valid on. There is no network parameter in the request and none in the response: the key belongs to the network of the instance that mints it, and any other host refuses it with an opaque 401 that is indistinguishable from an unknown key. Call this on the host you intend to trade against — api.testnet.nexus.xyz for play funds, api.nexus.xyz for real funds — and mint a separate key per network rather than reusing one. See “API keys are bound to one network” in the API description.

Authorizations

AuthorizationstringRequired

Session token from POST /auth/login. Used only for API key management (/keys endpoints). Session tokens are network-scoped exactly like API keys: a token from one network's POST /auth/login is not valid on another, so sign in and manage keys on the same host you intend to trade against.

Body

Optional body for POST /keys. Every field is optional; an absent or empty body is equivalent to {}.

labelstringOptional

Caller-supplied label for this key, echoed back on GET /keys.

ttl_msinteger · int64 · min: 86400000 · max: 7776000000Optional

How long the key should live, in milliseconds from creation time. Omit for a key that never expires. When present, must be a non-negative integer or the request is refused with 400 ttl_ms_invalid; a well-formed integer must fall in [24h, 90d] (86400000–7776000000) or the request is refused with 400 ttl_out_of_range.

Responses

200

Key created

application/json

A newly minted HMAC credential. secret is served exactly once, here: GET /keys serves KeyInfo, which has no secret field at all, and no other operation can recover it. A client that discards this response has lost the key.

key_idstringRequired

Public key identifier: nx_ followed by 16 lowercase hex characters. This is the value sent in the clear as the HMAC key id.

Example: nx_a1b2c3d4e5f67890

secretstringRequired

HMAC signing secret: 64 lowercase hex characters (32 random bytes). Never served again. The operation's example elides it; it is not a real length.

expires_at_msinteger · nullableRequired

Unix ms after which this key stops authenticating, or null if it never expires — the resolved value of the request's ttl_ms, handed back at the one moment the caller has full context. Nullable, not optional — the field is always present. Mirrors KeyInfo.expires_at_ms; see that field for the Postgres-only enforcement caveat.

400

Bad request: ttl_ms_invalid (ttl_ms present but not a non-negative integer, or the request body itself is unreadable — over 8KB or not valid JSON) or ttl_out_of_range (a well-formed ttl_ms outside [24h, 90d]).

401

Valid session token required for this host. A session token minted by another network's POST /auth/login is refused here like any invalid token.

post/keys

POST /v1/keys HTTP/1.1
Host: api.testnet.nexus.xyz
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 46

{
  "label": "my trading bot",
  "ttl_ms": 2592000000
}

{
  "key_id": "nx_a1b2c3d4e5f67890",
  "secret": "deadbeef..."
}

---

_{API version 0.9.122}