Key Management

#Key Management

These endpoints add, inspect, restrict, and remove API keys for PangoPerps accounts. Adding a key requires a wallet signature. The authenticated endpoints require the signed request headers listed with each operation.

#Get API Key

GET /v1/get_orderly_key
Mainnet: GET https://api.orderly.org/v1/get\\_orderly\\_key\\ Testnet: GET https://testnet-api.orderly.org/v1/get\\_orderly\\_key\\ Rate limit: 10 requests per second per IP address.

Query parameters: account_id (string, required) and orderly_key (string, required; public key being checked).

HTTP 200 returns success and required data: orderly_key (string), scope (string), and expiration (integer timestamp in milliseconds); tag (string) is optional. Server time is returned in timestamp (integer, milliseconds).

{"success":true,"data":{"orderly_key":"ed25519:7tEoJo5hMBKBrQsqmc8yw1xNfoQCFQBVwQT1eFafRNRf","scope":"read,trading","expiration":1689086651947,"tag":""},"timestamp":1702989203989}

#Add API Key

POST /v1/orderly_key
Mainnet: POST https://api.orderly.org/v1/orderly\\_key\\ Testnet: POST https://testnet-api.orderly.org/v1/orderly\\_key\\ Rate limit: 10 requests per second per IP address.

Submit application/json. The required message object contains brokerId (string; use pangoperps), chainId (integer, supported registration chain), orderlyKey (string), scope (string), timestamp (number, UNIX milliseconds), and expiration (number, UNIX milliseconds; no more than 365 days after creation). Scopes are independent: trading does not include read; request read,trading when both are needed. Optional message fields: chainType (EVM or SOL), tag (string), and subAccountId (string, to create the key for that sub-account). Include signature (string, EIP-712 signature of the message) and userAddress (string, signing wallet address).

HTTP 200 returns success, required data.orderly_key (string, the added key), optional data.id (integer, record ID), and server timestamp (integer, milliseconds).

#Remove API Key

POST /v1/client/remove_orderly_key
Mainnet: POST https://api.orderly.org/v1/client/remove\\_orderly\\_key\\ Testnet: POST https://testnet-api.orderly.org/v1/client/remove\\_orderly\\_key\\ Rate limit: 10 requests per second per IP address.

Submit application/json with orderly_key (string, required): the key to remove. Removal deactivates it for future use. This is an authenticated endpoint; include orderly-timestamp, orderly-account-id, orderly-key, and orderly-signature.

HTTP 200 returns success (boolean) and server timestamp (integer, milliseconds).

#Get Current API Key Info

GET /v1/client/key_info
Mainnet: GET https://api.orderly.org/v1/client/key\\_info\\ Testnet: GET https://testnet-api.orderly.org/v1/client/key\\_info\\ Rate limit: 10 requests per 60 seconds.

Required signed headers: orderly-timestamp (string, signed request time in milliseconds), orderly-account-id (string, authenticated account), orderly-key (string, public signing key), and orderly-signature (string, request signature). Optional query parameter key_status filters by ACTIVE, REMOVING, or REMOVED.

HTTP 200 returns required data.rows. Each row can include orderly_key (string), key_status (string), ip_restriction_list (string array), ip_restriction_status (one of ALLOW_RESTRICTION_LIST, ALLOW_ALL_IPS, DISALLOW_ALL_IPS), expiration (integer milliseconds), scope (string), and tag (string). The response also includes success and timestamp.

#Get API Key IP Restriction

GET /v1/client/orderly_key_ip_restriction
Mainnet: GET https://api.orderly.org/v1/client/orderly\\_key\\_ip\\_restriction\\ Testnet: GET https://testnet-api.orderly.org/v1/client/orderly\\_key\\_ip\\_restriction\\ Rate limit: 10 requests per 60 seconds.

Use the four signed headers described above. Required query parameter: orderly_key (string), the key to inspect.

HTTP 200 returns required data.account_id (string), data.orderly_key (string), data.ip_restriction_list (string array), and data.tag (string, may be null), plus success and server timestamp.

#Set API Key IP Restriction

POST /v1/client/set_orderly_key_ip_restriction
Mainnet: POST https://api.orderly.org/v1/client/set\\_orderly\\_key\\_ip\\_restriction\\ Testnet: POST https://testnet-api.orderly.org/v1/client/set\\_orderly\\_key\\_ip\\_restriction\\ Rate limit: 10 requests per 60 seconds.

Use the four signed headers. Required query parameters: orderly_key (string) and ip_restriction_list (string; comma-separated IP addresses or ranges allowed to use the key).

HTTP 200 returns required data.ip_restriction_list (string array), success, and server timestamp.

#Reset API Key IP Restriction

POST /v1/client/reset_orderly_key_ip_restriction
Mainnet: POST https://api.orderly.org/v1/client/reset\\_orderly\\_key\\_ip\\_restriction\\ Testnet: POST https://testnet-api.orderly.org/v1/client/reset\\_orderly\\_key\\_ip\\_restriction\\ Rate limit: 10 requests per 60 seconds.

Use the four signed headers. Required query parameters: orderly_key (string) and reset_mode (string): ALLOW_ALL_IPS removes the restriction list, while DISALLOW_ALL_IPS blocks every IP for the key.

HTTP 200 returns success (boolean) and server timestamp (integer, milliseconds).