Skip to main content
POST
Generate API Key

Authorizations

KALSHI-ACCESS-KEY
string
header
required

Your API key ID

KALSHI-ACCESS-SIGNATURE
string
header
required

Base64 signature of the pre-sign text (timestamp + method + path) made with the API key's algorithm - RSA-PSS with SHA-256 for RSA keys, Ed25519 for Ed25519 keys

KALSHI-ACCESS-TIMESTAMP
string
header
required

Request timestamp in milliseconds

Body

application/json
name
string
required

Name for the API key. This helps identify the key's purpose

key_type
enum<string>

Signature algorithm of an API key pair. rsa - 2048-bit RSA; requests are signed with RSA-PSS SHA-256. ed25519 - Ed25519 (RFC 8032) signatures over the same pre-sign text, with lower client-side signing cost. Defaults to rsa when omitted from a generate request, for compatibility with existing clients.

Available options:
rsa,
ed25519
scopes
enum<string>[]

List of scopes to grant to the API key. If the broad write parent scope is included, read must also be included. Child scopes may be granted without the broad parent scope. Defaults to full access (read, write) if not provided.

Scope granted to an API key. Parent scopes grant broad access; for example, read grants all read endpoints and write grants all write endpoints. Child scopes such as read::block_trade_accept, read::portfolio_balance, write::trade, write::transfer, write::fcm_risk (FCM subtrader creation, trading blocks, daily premium caps, and margin caps), and write::block_trade_accept grant only their specific endpoint group and can be granted without the parent scope.

Available options:
read,
write,
read::block_trade_accept,
read::portfolio_balance,
write::trade,
write::transfer,
write::fcm_risk,
write::block_trade_accept
subaccount
integer

If set, restricts the API key to a single sub-account (0-63) that you own. A restricted key may only read and trade on that sub-account; it cannot act on other sub-accounts, transfer funds between sub-accounts, or create sub-accounts. Omit to leave the key unrestricted. Mutually exclusive with fcm_subtrader_id.

Required range: 0 <= x <= 63
fcm_subtrader_id
string

FCM members only. If set, binds the API key to a single FCM subtrader that you own, spelled {your_user_id}_{suffix} with a suffix of 1-16 case-sensitive ASCII alphanumeric characters. The subtrader must already exist. A bound key is the institution's trading credential for that subtrader - FIX order-entry and market-data sessions, plus margin WebSocket sessions scoped to the subtrader's own data - and is denied on every REST endpoint, including key management. Mutually exclusive with subaccount.

Response

API key generated successfully

api_key_id
string
required

Unique identifier for the newly generated API key

private_key
string
required

Private key in PEM format - PKCS#1 (-----BEGIN RSA PRIVATE KEY-----) for rsa, PKCS#8 (-----BEGIN PRIVATE KEY-----) for ed25519. This must be stored securely and cannot be retrieved again after this response

key_type
enum<string>

Signature algorithm of an API key pair. rsa - 2048-bit RSA; requests are signed with RSA-PSS SHA-256. ed25519 - Ed25519 (RFC 8032) signatures over the same pre-sign text, with lower client-side signing cost. Defaults to rsa when omitted from a generate request, for compatibility with existing clients.

Available options:
rsa,
ed25519
warning
string | null

Present only when the minted key is bound to an FCM subtrader that is missing a per-subtrader risk control - the initial-margin cap (margin lane) or the event-contract daily cap. The mint still succeeds; the warning names each missing control - an event-contract subtrader without a daily cap has its event-contract orders rejected until one is set, while a margin subtrader without an initial-margin cap is bounded only by firm-level risk limits.