API keys

You can use API keys to trade and manage your lighter account programmatically. Each API key will be assigned an index, ranging from 0 to 254 - note that indexes {0,1,2,3} are reserved for desktop and mobile interfaces.

Each internal account, whether that's a master account or a sub-account, will have its own separate API key index - and each comes with a public & private key, and its own nonce.

Permissions

Secure withdrawals only need the API key because they can only go back to the L1 address that created the account. Fast withdrawals and transfers can go to other L1 addresses, so they also need a signature from the wallet's private key. See When an L1 signature is required.

List keys on an account:

curl "https://mainnet.zklighter.elliot.ai/api/v1/apikeys?account_index=123&api_key_index=255"

Authentication

To interact with certain endpoints, you will need to generate an auth token using your API private key. You can do so using our GO SDK, the create_auth_token_with_expiry() function in our Python SDK, or the WASM signer:

const deadline = Math.floor(Date.now() / 1000) + 3600; // unix seconds, max 8h ahead
const { authToken } = check(lighter.CreateAuthToken(deadline, API_KEY_INDEX, ACCOUNT_INDEX));

Each auth token can have a maximum expiry of 8 hours, and it uses the following structure: {expiry_unix}:{account_index}:{api_key_index}:{random_hex}. Refresh tokens before they expire.

Use it as:

• REST: Authorization: <token> header, or the auth query parameter where documented.
• WebSocket: "auth": "<token>" inside the subscribe message.

Authenticating a request also makes it count against your L1 address instead of your IP. See Rate Limits.

Read-only Authentication

Using a canonical auth code, you can generate read-only auth tokens - those won't allow placing trades nor request withdrawals (essentially, you won't be able to sign transactions hence initialize a signer client), but you will be able to access auth-gated data via API. Each read-only auth code can have a maximum expiry of 10 years, and a minimum of 1 day. They will use the following structure: ro:{account_index}:{single|all}:{expiry_unix}:{random_hex}. all covers the master account and its sub-accounts; single covers one account index.

You can generate one using the createToken endpoint, or via front-end. tokens/create is expensive: it costs 23,000 request weight, nearly a full minute of a Plus/Premium budget. Create tokens once and store them; don't create one per session.

👍

Read-only tokens for dashboards and AI agents

Giving a dashboard, tax tool or AI agent access to a user's Lighter data? Use a read-only token, not an API key.

Maker-only API keys

Clients on a premium account may mark up to 251 keys per account index as maker-only. Those keys will be restricted to 0ms speed bump transactions only:

• Post-only (ALO) orders
• Modify orders on ALO orders
• Cancel, and Cancel All orders

The direct benefit of using this configuration is having access to an optimized execution path, with reduced scheduling latency. Keys reserved by our front-end (0-3) cannot be set as maker-only, and we apply a one-hour cooldown in between changes.

You can set a list of keys as maker-only using setMakerOnlyApiKeys, and get a list of maker-only keys using getMakerOnlyApiKeys.

How to create API keys programmatically

While generating the API keys does not require your L1 private key, associating them with your Lighter account does. See Create accounts programmatically for a TypeScript example, or use the Python SDK or the GO SDK. You can also interact with Lighter's smart contract directly using the ChangePubKey function (this is particularly helpful if you're running a multi-sig).

Nonce management

Each API key has its own nonce. Nonce rules, skipping nonces, which rejected transactions consume a nonce, and why to use a separate API key per workload are covered in Core concepts.