# HTTP — `/v1/apiKey`

API keys authenticate `POST /v1/exchange`, the write WebSocket, and the
market-data WebSocket. Key management uses a Para wallet session, not an API
key.

```http
Authorization: Bearer <para-jwt>
X-Tessera-Wallet: 0x... # required when the JWT has multiple EVM wallets
```

Keep the raw API key in a server-side secret store. Browser clients must never
receive it.

## Create a key

```http
POST /v1/apiKey
Content-Type: application/json
```

```json
{}
```

`keyPrefix` is optional and must match `[A-Za-z0-9][A-Za-z0-9_-]{0,31}`; the
default is `tessera`. The response returns the raw `apiKey` once. Creating a
key revokes the previous active key in the same transaction. Keys expire 30
days after creation.

```jsonc
{
  "status": "ok",
  "data": {
    "id": "8f20b2e6-8b7a-4a0b-bf3d-6fb70c622f76",
    "keyPrefix": "tessera",
    "createdAtMs": 1780000000000,
    "expiresAtMs": 1782592000000,
    "revokedAtMs": null,
    "apiKey": "tessera_..."
  },
  "server_time_ms": 1780000000100
}
```

## Inspect the active key

```http
GET /v1/apiKey
```

Returns the same metadata without `apiKey`. `data` is `null` when the account
has no active key.

## Revoke the active key

```http
DELETE /v1/apiKey
```

```jsonc
{ "status": "ok", "data": { "revoked": true }, "server_time_ms": 1780000000100 }
```

`revoked` is `false` when there was no active key.

## Errors

| HTTP | Code | Meaning |
| --- | --- | --- |
| `401` | `unauthorized` | Missing bearer, or the token is not a valid Para JWT. |
| `403` | `not_whitelisted` | The wallet is not allowlisted. |
| `400` | `wallet_required` | The JWT holds several EVM wallets and `X-Tessera-Wallet` is missing. |
| `403` | `wallet_required` | The JWT holds no EVM wallet. |
| `403` | `wallet_not_connected` | `X-Tessera-Wallet` names a wallet the JWT does not hold. |
| `400` | `bad_request` | `X-Tessera-Wallet` is not an EVM address, or `keyPrefix` does not match the pattern. |

A revoked or expired key stops authenticating. Removing the wallet from the
allowlist also disables its live key within the 30-second key cache refresh.