Developers menu
Developers / API keys and scopes
Markdown copyAPI keys and scopes
One name, API key, for every key a program sends. A key carries a scope: the products it opens. The prefix names the scope, so a key pasted into a chart plugin is visibly not one that spends Lab credits.
Send it as Authorization: Bearer <key>.
| Scope | Prefix | Opens | Plan | Made on |
|---|---|---|---|---|
live | ftpl_ | The levels API (/api/v1), the platform integrations | LIVE | Account, Integrations |
lab | labk_ | The LAB API (/api/lab, /api/struct), the MCP server's lab_ tools | LAB | Account, LAB |
dataset | labk_ | The DATASET files (/snapshots/<day>.json.gz) and levels API history older than 90 days | DATASET | Account, LAB |
orders | ordk_ | The Orders API (/orders/api), the POSITIONS API (/api/positions), the Orders MCP server (/orders/mcp) | ORDERS | Account, Orders |
geo | gk_ | The Geo API (geo.firmtape.com/v1), the Geo MCP server | GEO | Account, Geo, Keys |
Keeping keys
- A key is shown once, when it is made. Store it like a password.
- Revoke a key on the page it was made on. A revoked key, or a plan that ended, stops working within a minute.
- Bearer requests need no cookie and no CSRF token.
- Finished sessions on the site and
GET /api/v1/symbolsneed no key at all.
Each scope
live ftpl_
- Read only: it cannot run LAB or spend credits.
- One key per machine: a
livekey answers from at most 3 client addresses in an hour. - A
labkey also opens the levels API, for plugins set up with one beforeftpl_keys existed.
lab labk_
- Jobs spend the account's LAB credits.
- An assistant can sign in through OAuth instead and holds the same scope.
dataset labk_
- Today the dataset opens with the account's
labkey, the same key as thelabscope; no LAB purchase is needed. - Planned: the dataset gets a key of its own (see Versioning, Planned).
orders ordk_
- On the Orders API and Team plans.
- Calls are counted per account, not per key.
geo gk_
- On the Geo API and Team plans.
- A plan allows a number of keys; after a move to a smaller plan the oldest keys keep working.
The key in the address (legacy)
Legacy: ?key=<key> in the address works on the levels API for platforms that cannot send headers (Sierra Chart). A key in an address can end up in logs and history: give each such tool its own key and revoke it if the address was ever shared. Every other API takes the header only.
The signing secret
whsec_ What your receiver verifies a webhook with. FirmTape sends with it; you never send it to FirmTape. Shown on the account page beside the webhook, rotated there.
Measurements of dealer positioning, never a forecast or a trade call. This page is built from FirmTape's public contract, the same files the OpenAPI document is built from; the tests hold them against the route code. Markdown: /docs/developers/keys.md.