Managing API Keys in the Developer Console

API keys are the credentials your applications use to call Arbitrage’s external data endpoints. Each key carries a name you choose, a set of permission scopes, and a per-minute rate limit. You can create multiple keys — one per application is recommended — and revoke any of them instantly if they are compromised or no longer needed. All key management calls require a valid console session token in the Authorization header.

The full API key is returned only once at creation. Predexy stores a hashed version and cannot recover the raw value. Copy and store the key securely before closing the response.

Creating a key

Send a POST request to /api/v1/console/keys with a name and optional configuration: Request fields:

Field	Type	Required	Default	Notes
`name`	string	Yes	—	1–100 characters. Use a descriptive label like `"Trading Bot – Prod"`.
`permissions`	string	No	`'["read:arbitrage","read:markets","read:questions"]'`	JSON-encoded array of permission strings.
`rate_limit`	integer	No	`60`	Requests per minute. Maximum is `10000`.

curl -X POST https://api.predexy.com/api/v1/console/keys \
  -H "Authorization: Bearer <your-access-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Trading Bot – Prod",
    "permissions": "[\"read:arbitrage\",\"read:markets\",\"read:questions\"]",
    "rate_limit": 120
  }'

curl -X POST https://api.predexy.com/api/v1/console/keys \
  -H "Authorization: Bearer <your-access-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Arbitrage Scanner",
    "permissions": "[\"read:arbitrage\"]",
    "rate_limit": 60
  }'

Response:

{
  "data": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "name": "Trading Bot – Prod",
    "key": "pdx_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
    "key_prefix": "pdx_a1b2c3d4",
    "permissions": "[\"read:arbitrage\",\"read:markets\",\"read:questions\"]",
    "rate_limit": 120
  },
  "message": "Save this API key — it will not be shown again."
}

The key field in the response is the value you use with the X-API-Key header. It will not appear in any subsequent API call.

Listing your keys

Retrieve all keys on your account with GET /api/v1/console/keys. The response includes metadata for each key but not the full key value — only the first 12 characters (key_prefix) are returned.

curl https://api.predexy.com/api/v1/console/keys \
  -H "Authorization: Bearer <your-access-token>"

Response:

{
  "data": [
    {
      "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "name": "Trading Bot – Prod",
      "key_prefix": "pdx_a1b2c3d4",
      "permissions": "[\"read:arbitrage\",\"read:markets\",\"read:questions\"]",
      "rate_limit": 120,
      "is_active": true,
      "last_used_at": "2026-04-25T14:32:00Z",
      "created_at": "2026-04-01T09:00:00Z"
    }
  ],
  "meta": {
    "count": 1
  }
}

Response fields:

Field	Description
`id`	UUID used to identify the key in management and analytics calls
`name`	The label you gave the key at creation
`key_prefix`	First 12 characters — use this to identify which physical key a prefix refers to
`permissions`	JSON-encoded permission array
`rate_limit`	Requests per minute
`is_active`	`false` if the key has been revoked
`last_used_at`	Timestamp of the most recent authenticated request, or `null` if never used
`created_at`	Creation timestamp

Save the id from this response. You will need it to pull usage statistics and logs for a specific key.

Revoking a key

Pass the key’s UUID to DELETE /api/v1/console/keys/{id}. Revocation takes effect immediately — there is no grace period.

curl -X DELETE \
  https://api.predexy.com/api/v1/console/keys/3fa85f64-5717-4562-b3fc-2c963f66afa6 \
  -H "Authorization: Bearer <your-access-token>"

Response:

{
  "data": {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "status": "revoked"
  }
}

Revocation is permanent. Any request that uses a revoked key immediately receives 401 INVALID_API_KEY. Revoked keys cannot be reactivated — create a new key if you need to restore access.

Using a key to call external endpoints

Pass the full key value in the X-API-Key header when calling any /api/v1/external/* endpoint:

curl "https://api.predexy.com/api/v1/external/arbitrage/opportunities?classification=actionable" \
  -H "X-API-Key: pdx_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"

curl "https://api.predexy.com/api/v1/external/markets" \
  -H "X-API-Key: pdx_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"

Every request made with the key is logged and visible in Usage Analytics.

Best practices

One key per application. Keep your keys scoped to a single service so you can revoke one without affecting others.
Use descriptive names. Labels like "Arbitrage Bot – Staging" or "Dashboard – Production" make it easy to identify keys in the list and in usage logs.
Revoke unused keys. If a key has not been used in weeks (check last_used_at), revoke it to limit your attack surface.
Store keys in environment variables. Never hardcode a key in source code or commit it to version control.
Request only the permissions you need. If your application only reads arbitrage data, set permissions to '["read:arbitrage"]' rather than the full default set.

Get Started

Core Concepts

Guides

Developer Console

Reference

Managing API Keys in the Developer Console

Creating a key

Listing your keys

Revoking a key

Using a key to call external endpoints

Best practices

​Creating a key

​Listing your keys

​Revoking a key

​Using a key to call external endpoints

​Best practices

Creating a key

Listing your keys

Revoking a key

Using a key to call external endpoints

Best practices