Authentication

Overview

Pro API uses secret bearer API keys for authentication. Each key is tied to your user account and has configurable permission scopes.

API keys grant access to your Daya Pro account. Treat them like passwords: never expose them in client-side code, share them publicly, or commit them to version control.

API Keys

Generating Keys

API keys are generated by the Daya team. Contact support@daya.co to request API access and specify the scopes you need.

Store your API key securely. The full key is only shared once. If you lose it, you’ll need to request a new key.

Key Format

All Pro API keys use this format:

daya_sk_[random-32-bytes-base64]

Example: daya_sk_xK9mN2pL8qR4sT6vW0yZaBcDeFgHiJkLmNoPqRsTuV The daya_sk_ prefix helps identify Daya keys in code scanning and secret detection tools.

Permission Scopes

Scope	Permissions	Use Case
Read	View orders, trades, balances, account data, deposit addresses, and withdrawal options	Dashboards, analytics, monitoring, reconciliation
Trade	Place and cancel orders, initiate withdrawals (includes Read)	Trading bots, automated strategies, treasury movement
Write	Manage support-enabled webhooks (includes Read)	Webhook configuration arranged through Daya support

Trade scope automatically includes Read permissions. You don’t need to select both.

Trade keys authorize fund movement. Only store Trade-scoped keys in trusted server-side systems that are allowed to place orders and initiate withdrawals from the account.

Key Limits

Maximum 10 API keys per user
Keys can be revoked immediately

Key Status

Status	Description
`active`	Key is valid and operational
`revoked`	Key was manually revoked by user

Revoked keys cannot be reactivated. Create a new key if needed.

Base URL

All Pro API requests use:

https://api.pro.daya.co/public/v1

Making Authenticated Requests

Include your API key in the X-Api-Key header:

curl --request GET \
  --url https://api.pro.daya.co/public/v1/orders \
  --header 'X-Api-Key: daya_sk_YOUR_API_KEY'

const response = await fetch('https://api.pro.daya.co/public/v1/orders', {
  headers: {
    'X-Api-Key': 'daya_sk_YOUR_API_KEY'
  }
});

const data = await response.json();

import requests

headers = {
    'X-Api-Key': 'daya_sk_YOUR_API_KEY'
}

response = requests.get(
    'https://api.pro.daya.co/public/v1/orders',
    headers=headers
)

client := &http.Client{}
req, _ := http.NewRequest("GET", "https://api.pro.daya.co/public/v1/orders", nil)
req.Header.Add("X-Api-Key", "daya_sk_YOUR_API_KEY")
resp, _ := client.Do(req)

Public Endpoints

Some endpoints don’t require authentication:

Endpoint	Description
`GET /public/v1/markets`	List all trading markets
`GET /public/v1/markets/{symbol}`	Get a specific market
`GET /public/v1/orderbook/{symbol}`	Get orderbook snapshot
`GET /public/v1/last-price/{symbol}`	Get latest price and 24h change
`GET /public/v1/market-trades/{symbol}`	List recent market trades

Security Best Practices

Store keys securely

Use environment variables or secret management systems:

.env

DAYA_PRO_API_KEY=daya_sk_xK9mN2pL8qR4sT6vW0yZ...

Never hardcode keys in source code or commit them to Git.

Use minimum required scopes

Only grant the permissions your application needs:

Read-only applications (dashboards, analytics): Use Read scope only
Trading and treasury automation: Use Trade scope only for systems allowed to place orders and initiate withdrawals
Webhook management: Contact support to configure Pro webhook setup and Write scope

Create separate keys for different use cases.

Error Responses

401 Unauthorized

Missing or invalid API key:

{
  "success": false,
  "message": "Unauthorized",
  "error": {
    "code": "API_KEY_INVALID",
    "message": "Invalid or missing API key"
  },
  "timestamp": "2024-01-15T10:30:00Z"
}

Common causes:

Missing X-Api-Key header
Invalid key format (must start with daya_sk_)
Key has been revoked

403 Forbidden

Insufficient permissions:

{
  "success": false,
  "message": "Forbidden",
  "error": {
    "code": "API_KEY_INVALID_SCOPE",
    "message": "Insufficient scope for this operation"
  },
  "timestamp": "2024-01-15T10:30:00Z"
}

Common causes:

Using Read-only key to place orders (requires Trade scope)
Using non-Write key to manage webhooks (requires Write scope)
User account is suspended

Testing Authentication

Verify your API key works:

curl --request GET \
  --url https://api.pro.daya.co/public/v1/balances \
  --header 'X-Api-Key: daya_sk_YOUR_API_KEY'

async function testAuth() {
  const response = await fetch(
    'https://api.pro.daya.co/public/v1/balances',
    {
      headers: { 'X-Api-Key': 'daya_sk_YOUR_API_KEY' }
    }
  );

  if (response.ok) {
    console.log('Authentication successful');
    const result = await response.json();
    console.log('Balances:', result.data);
  } else {
    console.error('Authentication failed:', response.status);
  }
}

import requests

headers = {'X-Api-Key': 'daya_sk_YOUR_API_KEY'}
response = requests.get(
    'https://api.pro.daya.co/public/v1/balances',
    headers=headers
)

if response.ok:
    print('Authentication successful')
    print('Balances:', response.json()['data'])
else:
    print('Authentication failed:', response.status_code)

Expected response:

{
  "success": true,
  "message": "Balances retrieved successfully",
  "data": {
    "balances": []
  },
  "timestamp": "2024-01-15T10:30:00Z"
}

Getting Started

Markets

Account

Orders

Trades

Deposits

Withdrawals

Webhooks API

Webhooks

Overview

API Keys

Generating Keys

Key Format

Permission Scopes

Key Limits

Key Status

Base URL

Making Authenticated Requests

Public Endpoints

Security Best Practices

Error Responses

401 Unauthorized

403 Forbidden

Testing Authentication

Next Steps

Quick Start

API Reference

​Overview

​API Keys

​Generating Keys

​Key Format

​Permission Scopes

​Key Limits

​Key Status

​Base URL

​Making Authenticated Requests

​Public Endpoints

​Security Best Practices

​Error Responses

​401 Unauthorized

​403 Forbidden

​Testing Authentication

​Next Steps

Quick Start

API Reference

Overview

API Keys

Generating Keys

Key Format

Permission Scopes

Key Limits

Key Status

Base URL

Making Authenticated Requests

Public Endpoints

Security Best Practices

Error Responses

401 Unauthorized

403 Forbidden

Testing Authentication

Next Steps