> ## Documentation Index
> Fetch the complete documentation index at: https://docs.convallax.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API Key

> Generate a maker API key. The secret is returned once and works immediately.

Generate a new API key for market-making. Authenticate with your [Privy access token](/guides/authentication).

<Warning>
  The plaintext `key` is returned **once** in this response and never again. Store it securely the moment you receive it — if you lose it, revoke it and create a new one.
</Warning>

The key works immediately as a maker credential: send it as `X-API-Key` on the [quote-request stream](/api-reference/market-maker/quote-stream) and the [REST quote endpoints](/api-reference/market-maker/submit-quote). All quotes submitted with it are attributed to your account's `makerId`.

<Note>
  In Convallax there is no separate market-maker role — any signed-in user can generate a key and begin quoting. Takers do not need a key at all; their authorization is the on-chain `fill()`.
</Note>


## OpenAPI

````yaml api-reference/openapi.json POST /v1/user/api-keys
openapi: 3.1.0
info:
  title: Convallax RFQ API
  version: 3.0.0
  description: >-
    REST surface for the Convallax options protocol — a non-custodial
    request-for-quote marketplace for European calls and puts on Polymarket YES
    outcomes, settled on Polygon.


    **Wire format**: JSON. Successful responses include `"success": true`;
    failures return `{ "success": false, "error": "..." }`.


    **Authentication**: Takers (traders) need no API key — authorization happens
    on-chain at `fill()`. Market makers authenticate with a per-MM API key sent
    as `X-API-Key` (or `?apiKey=`).


    **Streaming**: Quote-request and live-pricing streams use Server-Sent Events
    and the post-trade channel uses WebSocket; those are documented in the
    guides and are not part of this request/response reference.
servers:
  - url: https://api.convallax.com
    description: Production
security: []
tags:
  - name: Series
    description: Browse registered option series available for trading.
  - name: Trading
    description: Open quote requests, read live quotes, and commit to the best price.
  - name: Market Maker
    description: >-
      Submit quotes and confirmation signatures. Authenticated with a per-MM API
      key.
  - name: Settlement
    description: Compute TWAP resolution prices and sign settlement attestations.
  - name: Testnet
    description: Polygon Amoy testnet USDC faucet.
  - name: User
    description: >-
      Account profile and self-serve API keys. Authenticated with a Privy access
      token.
paths:
  /v1/user/api-keys:
    post:
      tags:
        - User
      summary: Create API Key
      description: >-
        Create a new API key. The plaintext `key` is returned **once** in this
        response and never again — store it securely. The key works immediately
        as a maker `X-API-Key` for the quote-request stream and REST endpoints,
        attributed to your `makerId`.
      operationId: createApiKey
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApiKeyInput'
      responses:
        '201':
          description: Key created (plaintext returned once)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyCreatedResponse'
        '401':
          $ref: '#/components/responses/Error'
        '503':
          $ref: '#/components/responses/Error'
      security:
        - PrivyJWT: []
components:
  schemas:
    CreateApiKeyInput:
      type: object
      properties:
        name:
          type: string
          description: Optional label for the key.
          example: production-bot
    ApiKeyCreatedResponse:
      type: object
      properties:
        success:
          type: boolean
          const: true
        key:
          type: string
          description: The plaintext API key. Shown ONCE — store it now.
          example: mk_live_9f8e7d6c5b4a3f2e1d0c9b8a7...
        apiKey:
          $ref: '#/components/schemas/ApiKeyMeta'
    ApiKeyMeta:
      type: object
      description: API key metadata. Never includes the secret.
      properties:
        id:
          type: string
          format: uuid
          example: 8f3c2b1a-1d2e-4c3b-9a8f-6e5d4c3b2a1f
        name:
          type: string
          example: production-bot
        keyPrefix:
          type: string
          description: Non-secret prefix for identification.
          example: mk_live_9f8e7d6
        createdAt:
          type: string
          format: date-time
          example: '2026-06-16T18:05:00.000Z'
        lastUsedAt:
          type: string
          format: date-time
          nullable: true
          example: null
        revokedAt:
          type: string
          format: date-time
          nullable: true
          example: null
    ErrorResponse:
      type: object
      required:
        - success
        - error
      properties:
        success:
          type: boolean
          const: false
        error:
          type: string
          description: Human-readable error message.
          example: Quote request not found or expired
  responses:
    Error:
      description: Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    PrivyJWT:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Privy access token from the Convallax dashboard, sent as `Authorization:
        Bearer <jwt>`.

````