> ## Documentation Index
> Fetch the complete documentation index at: https://docs.legend.trade/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and API keys

> Create and revoke account-scoped trading credentials.

## Bearer authentication

```http theme={null}
Authorization: Bearer lg_trade_<64 hexadecimal characters>
```

Treat the key as a secret. The API stores its SHA-256 hash. Read-only keys have `trading:read`; trading keys created in settings also have `trading:write`. The server checks current account ownership, key revocation, scopes, network, and feature availability.

## Wallet-signed registration

Settings handles registration for most integrations. The low-level endpoints are documented under [API key actions](/api-reference/trading/keys).

A wallet signs EIP-712 typed data with domain name `Legend Trading API`, version `1`, and a `salt` equal to `keccak256(UTF8("https://app.legend.trade/api/trading"))`. Use this exact audience for production registration and revocation.

`TradingAccess` contains these fields, in order:

| Field     | Type    | Value                                                                     |
| --------- | ------- | ------------------------------------------------------------------------- |
| account   | string  | Legend account UUID                                                       |
| network   | string  | `hyperliquid_mainnet`                                                     |
| keyHash   | string  | SHA-256 of the entire plaintext API key, lowercase hex without `0x`       |
| policy    | string  | JSON with the `scopes` array sorted lexicographically, without whitespace |
| issuedAt  | uint256 | Current Unix time in milliseconds                                         |
| expiresAt | uint256 | `0`, meaning valid until revoked                                          |

The JSON consent uses snake\_case field names and `expires_at: null` (or omits that field). A signature must be registered within five minutes of `issued_at`. This freshness requirement applies to registration only; the created key does not expire.

The signed network, account, permissions, and audience cannot be changed. Create a new key to change permissions. Only main-account, mainnet grants are accepted. A key hash cannot be registered again, including after revocation.

## Revocation

Settings signs `RevokeTradingAccess` under the same domain, with `account` and `keyHash` as string fields. The owner signature is required; knowledge of a key hash alone cannot revoke a key. Revocation works even if trading is disabled. A revocation submitted before registration prevents later replay of that registration.

Existing grants that explicitly authorized a finite expiry retain that signed restriction; they are not silently extended. Create a new key for access until revocation.