Keys are created, rotated and revoked by Bullionwale on your request. Contact your Bullionwale relationship manager or the Bullionwale desk for any of the changes on this page, and quote the key’s key id (from GET /me), never its secret.
Rotation
Rotating a key replaces it with a new one without downtime:
- You ask Bullionwale to rotate the key. You receive the new key, shown once.
- For an overlap period, the old key and the new key both work. The overlap is 60 minutes unless you agree another length with Bullionwale, and it can never be longer than Bullionwale’s maximum (24 hours by default).
- Switch your systems to the new key at your own pace within the overlap. Check each one with
GET /me: key_id shows which key it is using.
- When the overlap ends, the old key is refused with
401 credential_rotated.
A rotation with a 0-minute overlap ends the old key at once: it is revoked as part of the rotation and refused with 401 credential_revoked from that moment, so switch to the new key before you ask for one.
The new key keeps the old key’s scopes, and its expiry date unless a new one is agreed.
Idempotency keys are remembered per account, so an order retry that goes out with the new key still finds an order the old key placed. See Idempotency.
Rotate on a schedule, and whenever someone who had access to a key leaves. Keep the key in one place (your secret manager) so a rotation is a single change.
Expiry
A key can be issued with an expiry date. From that moment it is refused with 401 credential_expired; nothing else changes on your account. Ask for a rotation before the date to get a replacement in time. A key without an expiry date works until it is rotated or revoked.
Revocation
Revoking a key stops it immediately, including a key inside a rotation overlap. From then on it is refused with 401 credential_revoked.
Ask Bullionwale to revoke a key at once if it may have leaked, for example if it was committed to a repository, pasted into a ticket or written to a log.
Revoking one key does not affect your other keys, your orders or your positions.
What happens to orders in flight
Every production order checks the key again at the moment it is accepted:
- If the key was revoked, rotated out or expired before that moment, the order is refused with that code and nothing is booked.
- An order that was already accepted keeps going. A
pending order can still be confirmed and become open.
If a retry is refused because its key no longer works, the refusal says nothing about the original order. Look it up with a key that still works (see Recovering an order).
Codes at a glance
