> ## Documentation Index
> Fetch the complete documentation index at: https://docs.daya.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secure your Pro API requests with API keys

## Overview

Pro API uses secret bearer API keys for authentication. Each key is tied to your user account and has configurable permission scopes.

<Warning>
  API keys grant access to your Daya Pro account. Treat them like passwords: **never** expose them in client-side code, share them publicly, or commit them to version control.
</Warning>

## API Keys

### Generating Keys

<Info>
  API keys are generated by the Daya team. Contact [support@daya.co](mailto:support@daya.co) to request API access and specify the scopes you need.
</Info>

<Warning>
  **Store your API key securely.** The full key is only shared once. If you lose it, you'll need to request a new key.
</Warning>

### Key Format

All Pro API keys use this format:

```
daya_sk_[random-32-bytes-base64]
```

Example: `daya_sk_xK9mN2pL8qR4sT6vW0yZaBcDeFgHiJkLmNoPqRsTuV`

The `daya_sk_` prefix helps identify Daya keys in code scanning and secret detection tools.

### Permission Scopes

| Scope     | Permissions                                                                            | Use Case                                              |
| --------- | -------------------------------------------------------------------------------------- | ----------------------------------------------------- |
| **Read**  | View orders, trades, balances, account data, deposit addresses, and withdrawal options | Dashboards, analytics, monitoring, reconciliation     |
| **Trade** | Place and cancel orders, initiate withdrawals (includes Read)                          | Trading bots, automated strategies, treasury movement |
| **Write** | Manage support-enabled webhooks (includes Read)                                        | Webhook configuration arranged through Daya support   |

<Info>
  **Trade** scope automatically includes **Read** permissions. You don't need to select both.
</Info>

<Warning>
  **Trade** keys authorize fund movement. Only store Trade-scoped keys in trusted server-side systems that are allowed to place orders and initiate withdrawals from the account.
</Warning>

### Key Limits

* Maximum **10 API keys** per user
* Keys can be revoked immediately

### Key Status

| Status    | Description                      |
| --------- | -------------------------------- |
| `active`  | Key is valid and operational     |
| `revoked` | Key was manually revoked by user |

<Info>
  Revoked keys cannot be reactivated. Create a new key if needed.
</Info>

## Base URL

All Pro API requests use:

```
https://api.pro.daya.co/public/v1
```

## Making Authenticated Requests

Include your API key in the `X-Api-Key` header:

<CodeGroup>
  ```bash cURL theme={null}
  curl --request GET \
    --url https://api.pro.daya.co/public/v1/orders \
    --header 'X-Api-Key: daya_sk_YOUR_API_KEY'
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://api.pro.daya.co/public/v1/orders', {
    headers: {
      'X-Api-Key': 'daya_sk_YOUR_API_KEY'
    }
  });

  const data = await response.json();
  ```

  ```python Python theme={null}
  import requests

  headers = {
      'X-Api-Key': 'daya_sk_YOUR_API_KEY'
  }

  response = requests.get(
      'https://api.pro.daya.co/public/v1/orders',
      headers=headers
  )
  ```

  ```go Go theme={null}
  client := &http.Client{}
  req, _ := http.NewRequest("GET", "https://api.pro.daya.co/public/v1/orders", nil)
  req.Header.Add("X-Api-Key", "daya_sk_YOUR_API_KEY")
  resp, _ := client.Do(req)
  ```
</CodeGroup>

## Public Endpoints

Some endpoints don't require authentication:

| Endpoint                                | Description                     |
| --------------------------------------- | ------------------------------- |
| `GET /public/v1/markets`                | List all trading markets        |
| `GET /public/v1/markets/{symbol}`       | Get a specific market           |
| `GET /public/v1/orderbook/{symbol}`     | Get orderbook snapshot          |
| `GET /public/v1/last-price/{symbol}`    | Get latest price and 24h change |
| `GET /public/v1/market-trades/{symbol}` | List recent market trades       |

## Security Best Practices

<AccordionGroup>
  <Accordion title="Store keys securely">
    Use environment variables or secret management systems:

    ```bash .env theme={null}
    DAYA_PRO_API_KEY=daya_sk_xK9mN2pL8qR4sT6vW0yZ...
    ```

    Never hardcode keys in source code or commit them to Git.
  </Accordion>

  <Accordion title="Use minimum required scopes">
    Only grant the permissions your application needs:

    * **Read-only applications** (dashboards, analytics): Use Read scope only
    * **Trading and treasury automation**: Use Trade scope only for systems allowed to place orders and initiate withdrawals
    * **Webhook management**: Contact support to configure Pro webhook setup and Write scope

    Create separate keys for different use cases.
  </Accordion>
</AccordionGroup>

## Error Responses

### 401 Unauthorized

Missing or invalid API key:

```json theme={null}
{
  "success": false,
  "message": "Unauthorized",
  "error": {
    "code": "API_KEY_INVALID",
    "message": "Invalid or missing API key"
  },
  "timestamp": "2024-01-15T10:30:00Z"
}
```

**Common causes:**

* Missing `X-Api-Key` header
* Invalid key format (must start with `daya_sk_`)
* Key has been revoked

### 403 Forbidden

Insufficient permissions:

```json theme={null}
{
  "success": false,
  "message": "Forbidden",
  "error": {
    "code": "API_KEY_INVALID_SCOPE",
    "message": "Insufficient scope for this operation"
  },
  "timestamp": "2024-01-15T10:30:00Z"
}
```

**Common causes:**

* Using Read-only key to place orders (requires Trade scope)
* Using non-Write key to manage webhooks (requires Write scope)
* User account is suspended

## Testing Authentication

Verify your API key works:

<CodeGroup>
  ```bash cURL theme={null}
  curl --request GET \
    --url https://api.pro.daya.co/public/v1/balances \
    --header 'X-Api-Key: daya_sk_YOUR_API_KEY'
  ```

  ```javascript JavaScript theme={null}
  async function testAuth() {
    const response = await fetch(
      'https://api.pro.daya.co/public/v1/balances',
      {
        headers: { 'X-Api-Key': 'daya_sk_YOUR_API_KEY' }
      }
    );

    if (response.ok) {
      console.log('Authentication successful');
      const result = await response.json();
      console.log('Balances:', result.data);
    } else {
      console.error('Authentication failed:', response.status);
    }
  }
  ```

  ```python Python theme={null}
  import requests

  headers = {'X-Api-Key': 'daya_sk_YOUR_API_KEY'}
  response = requests.get(
      'https://api.pro.daya.co/public/v1/balances',
      headers=headers
  )

  if response.ok:
      print('Authentication successful')
      print('Balances:', response.json()['data'])
  else:
      print('Authentication failed:', response.status_code)
  ```
</CodeGroup>

Expected response:

```json theme={null}
{
  "success": true,
  "message": "Balances retrieved successfully",
  "data": {
    "balances": []
  },
  "timestamp": "2024-01-15T10:30:00Z"
}
```

## Next Steps

<CardGroup cols={2}>
  <Card title="Quick Start" icon="rocket" href="/pro/quickstart">
    Place your first order
  </Card>

  <Card title="API Reference" icon="code" href="/pro/api-reference/list-markets">
    Explore all endpoints
  </Card>
</CardGroup>