# API key generation

To securely interact with the Bitpanda Public API, you need to authenticate your requests using an API key. Your API key acts as a secret token that identifies your account and determines which actions your application is authorized to perform.

### Generating your API key

You can create and manage API keys directly within your Bitpanda account.

**Quick Link:** [Bitpanda API Settings](https://app.bitpanda.com/my-account/apikey)

**Step-by-step guide:**

1. Log in to your Bitpanda account and open your **Account settings**.
2. Navigate to the **API Keys** section.
3. Click to create a **New API key**.
4. Enter a descriptive **API key name** (e.g., "Portfolio Tracker" or "Trading Bot") to help you identify it later.
5. Select the required **Scopes** based on your application's needs (see the scope breakdown below).
6. Set an **Expiration date**. *Note: For security reasons, Bitpanda keys are valid for a maximum of 1 year.*
7. *(Optional but recommended)* Toggle the **IP allow list** to specify exactly which IP addresses are authorized to use this key. 
8. Click **Generate API key**.
9. **Copy and store the key securely.** The full key is displayed only once. If you lose it, you will need to generate a new one.

---

### Using your API key

Once generated, you must include your API key in the header of all authenticated REST requests. Use the `x-api-key` header parameter:

` ` `http
x-api-key: YOUR_API_KEY_STRING
` ` `

---

### Understanding Scopes

Scopes define the exact permissions granted to an API key. When creating a key, you must explicitly check the boxes for the endpoints you intend to use.

| Scope | Permissions Granted |
| :--- | :--- |
| **Trade (Read)** | Access market data, view available assets, fiat currencies, and current trading quotes. |
| **Trade (Write)** | Create new trading quotes and accept them to execute trades. |
| **Earn (Read)** | View available Bitpanda Earn configurations and monitor your active stakes. |
| **Earn (Write)** | Execute staking and unstaking actions for supported assets. |
| **Balances** | Retrieve your current account balances and overall portfolio data. |
| **Transaction** | Access historical account operations, including deposits, withdrawals, and past trades. |

---

### Security Best Practices

> **Warning:** Treat your API keys like passwords. Compromised keys can lead to unauthorized access to your account data and funds.

* **Principle of least privilege:** Only enable the exact scopes your application needs. If your integration only reads market data, do not grant it `Trade (Write)` or `Earn (Write)` permissions.
* **Use IP allowlisting:** Whenever possible, restrict API access to your server's specific static IP address.
* **Never commit keys to code:** Do not hardcode API keys in your application source code or push them to public repositories (like GitHub). Store them securely using environment variables or a secret manager.
* **Rotate keys regularly:** Keep track of your key's expiration date and plan to generate a new key and update your application before the old one expires.