Authentication

Overview

API Key Authentication

API keys are the recommended method for trading bots and automated systems. They provide secure, long-lived access to the trading API.

Creating an API Key

1. Log in to your dashboard
2. Navigate to the API Keys section
3. Click "Create New Key" and give it a name
4. Copy the key immediately - it won't be shown again

Using Your API Key

Include your API key in the X-API-Key header:

import requests

API_KEY = "pe_your_api_key_here"
BASE_URL = "https://api.paperx.co/v1/exchanges/hyperliquid"

response = requests.post(
    f"{BASE_URL}/info",
    headers={
        "Content-Type": "application/json",
        "X-API-Key": API_KEY
    },
    json={"type": "allMids"}
)

print(response.json())

curl -X POST https://api.paperx.co/v1/exchanges/hyperliquid/info \
  -H "Content-Type: application/json" \
  -H "X-API-Key: pe_your_api_key_here" \
  -d '{"type": "allMids"}'

const API_KEY = "pe_your_api_key_here";
const BASE_URL = "https://api.paperx.co/v1/exchanges/hyperliquid";

const response = await fetch(`${BASE_URL}/info`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": API_KEY
  },
  body: JSON.stringify({ type: "allMids" })
});

const data = await response.json();
console.log(data);

JWT Token Authentication

JWT tokens are used for dashboard access and web applications. Tokens expire after 24 hours and must be refreshed.

Getting a JWT Token

Obtain a JWT token by logging in with your email and password:

POST /v1/auth/login
Content-Type: application/json

{
  "email": "your@email.com",
  "password": "your_password"
}

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "user_id": "uuid-here",
  "email": "your@email.com"
}

Using JWT Tokens

Include the token in the Authorization header:

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

Security Best Practices

Rate Limits

Rate limits are applied per API key:

Rate limit headers are included in all responses:

• X-RateLimit-Limit - Maximum requests per minute
• X-RateLimit-Remaining - Requests remaining
• X-RateLimit-Reset - Unix timestamp when limit resets