Skip to main content
You cannot create API keys yourself, and there is no key page in the Bullionwale app yet. Bullionwale turns on API access for your account and issues the keys. Test keys are available on request. Production keys are not issued while production trading is switched off: see the availability notice on the introduction.

​
Ask for access

Contact your Bullionwale relationship manager or the Bullionwale desk and ask for:
  1. API access for your account. Without it every call is refused with 403 api_access_disabled.
  2. A test key to build and test your integration. Start here even if you only plan to trade in production.
  3. The scopes the key needs (see Scopes). To place orders, ask for orders:write.
  4. Optionally, an expiry date for the key, and a name that tells you which of your systems uses it (for example order-bot). The name comes back as key_name from GET /me.
A live key for production is a separate request, made when you meet the production access requirements.

​
Receive and store the key

The full key is shown once, when it is created or rotated. Bullionwale cannot show it to you again; it can only replace it. Store it in a secret manager straight away.
A key is one string with four parts separated by dots:
  • bwk_test or bwk_live says which environment the key works in.
  • The key id is public. GET /me returns it as key_id, and it is safe to quote when you talk to Bullionwale about a key.
  • The secret is the last part. Never share it, including with Bullionwale staff.
Keep keys out of source code, URLs, browser or mobile app code, logs and tickets. If a key may have leaked, ask Bullionwale to revoke it at once (see Credentials).

​
Send the key

Send the key on every call in the X-API-Key header:
  • A test key works only on the test paths (/api/trading/test/v1), and a live key only on the production paths (/api/trading/v1). The other combination is refused with 401 wrong_environment.
  • Your web or mobile login is never accepted by this API, and an API key is never accepted by the web or mobile app.

​
Scopes

A key carries scopes that decide which calls it may make: A new key gets account:read, rates:read and orders:read unless you ask otherwise. orders:write is granted only when you ask for it. A call that needs a scope the key lacks is refused with 403 insufficient_scope. A read-only key (without orders:write) is a good choice for dashboards and reconciliation jobs that never place orders.

​
How many keys

Each account can have a limited number of active keys per environment (five by default; Bullionwale’s limit may differ). Use separate keys for separate systems, so that one can be rotated or revoked without touching the others.

​
Check a key

GET /me shows the account and key behind the X-API-Key header, the key’s scopes, and production_trading_available. Run it whenever you install a new key. See the quickstart for an example.