Skip to main content
API keys authenticate private account and trading requests. Each key has a public key and a secret key, an account scope, and a set of permissions.

​
Create an API key

  1. Sign in at qfex.com and select your profile in the bottom right corner.
  2. Navigate to Developer Settings via the carousel.
  3. Click Generate public and secret API Keys.
  4. Ensure you have 2FA enabled.
  5. Provide a descriptive name, choose the account access and permissions the key needs, and confirm.
  6. Copy the generated key and store it securely—it will only be shown once.

​
Account access and permissions

Each API key is limited by both its account access and its permissions. A request must satisfy both settings. For account access, choose either:
  • A specific account: The key can be used only with the selected primary account or subaccount.
  • All accounts: The key can be used with any account you own. Use this only when the integration genuinely needs access across accounts.
Permissions control what the key can do: Create keys with only the permissions required for their intended use. For example, reporting software may need view permissions but should not need order execution or withdrawal access.

​
Use an API key with a third party

If you authorize a trusted third-party application to access QFEX with an API key:
  1. Create a dedicated key for that application. Do not reuse your personal integration key.
  2. Limit it to the required account and enable only the permissions the application needs.
  3. Provide the public and secret key through a secure channel. The application never needs your QFEX password or MFA codes.
  4. The application must keep the secret key on a secure server and use it to sign authenticated requests. It must never expose the secret in browser code, mobile applications, logs, URLs, or source control.
  5. Revoke the key from Developer Settings when the integration is no longer needed or if either credential may have been exposed.
The secret key is displayed only once. QFEX cannot display it again after creation; create a replacement key if it is lost. For direct integrations, see WebSocket authentication for the signing flow. If a third-party application supports QFEX OAuth, use OAuth instead of sharing an API secret.
Treat the secret key like a password. Anyone who has both key values can act within the account access and permissions you selected.