Authentication

API Key authentication and permission management

The BaseVol API uses API Key authentication via the X-API-Key HTTP header. All authenticated endpoints require a valid API key.

API Key Format

API keys follow a specific format depending on the environment:

Environment	Prefix	Example
Production	bvk_live_	bvk_live_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345
Testnet	bvk_test_	bvk_test_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345

Using Your API Key

Include the API key in the X-API-Key header with every authenticated request:

curl -H "X-API-Key: bvk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  https://api.basevol.com/api/v1/account

The full API key is only shown once at creation. Store it securely. If lost, you must regenerate the key.

Creating an API Key

1. Log in to basevol.com and connect your wallet

2. Navigate to Settings > API Keys

3. Click Create API Key

4. Enter a descriptive name

5. Select permissions: READ, TRADE, or both

6. Optionally add IP whitelist entries

7. Click Create and copy the key immediately

Permissions

Each API key can have one or more permissions:

Permission	Access
READ	View account info, balances, positions, and orders
TRADE	Place orders, cancel orders, and close positions

A key with only READ permission cannot place or cancel orders. Use TRADE permission for trading bots.

IP Whitelisting

You can restrict API key usage to specific IP addresses for additional security.

• Up to 10 IP addresses per key

• Supports individual IPs and CIDR notation

• If no IPs are configured, the key works from any IP address

Key Limits by Tier

The number of API keys you can create depends on your tier:

Tier	Max Keys
Basic	3
Pro	10
Enterprise	50

Managing API Keys

From the dashboard, you can:

• Update — Change name, permissions, or IP whitelist

• Regenerate — Generate a new key value (old key is immediately invalidated)

• Revoke — Permanently deactivate a key

Security Best Practices

• Never expose API keys in client-side code or public repositories

• Use environment variables to store keys in your applications

• Enable IP whitelisting for production trading bots

• Use the minimum required permissions — use READ only if you don't need trading

• Rotate keys regularly and revoke unused keys

• Monitor API usage via the /api/v1/account/api-usage endpoint