Skip to main content
Every CSBoard API request (except GET /v1/health) must include a valid API key. Keys belong to the csb_pub_ namespace, are scoped to either read-only or trading access, and are tied to your CSBoard account. The server stores only the SHA-256 hash of each key — the raw secret is shown once at creation and never again, so store it somewhere safe.

​
Get your API key

1

Open your profile API tab

Go to csboard.com/profile?tab=api and sign in if prompted.
2

Generate a new key

Click Generate key. Choose a label that identifies what the key is for (e.g. price-tracker-prod).
3

Copy the key immediately

Your new csb_pub_… key is shown only once. Copy it to your secrets manager or environment variables before closing the dialog.
4

Enable trading (optional)

If you need to place orders, find the key in your key list and toggle Trading enabled. See the warning below before doing this.
Trading capability is separate from read access and must be explicitly enabled per key on your profile page. A key without trading enabled will return 403 trading_not_enabled when it attempts to call POST /v1/orders. Never enable trading on a key that you share with third parties or embed in client-side code.

​
Pass your key on requests

Send the key as a Bearer token in the Authorization header on every request:
As a convenience you can also pass the key as the api_key query parameter — useful for quick tests in a browser or tools that don’t support custom headers:
Prefer the Authorization header in production; query parameters are more likely to appear in server logs.

​
Key capabilities

Create separate keys for separate workloads (e.g. one read key for your price dashboard, one trading key for your buy bot) so you can revoke them independently without disrupting everything at once.

​
Restricting a key to your servers

A key can optionally be bound to a set of IP addresses or CIDR ranges, set at csboard.com/profile?tab=api. Requests from anywhere else are refused with 403 ip_not_allowed, and the response quotes the address we saw so you can tell a wrong entry from a moved egress IP. An empty list means no restriction. Saving a list that would not admit your own current address is refused rather than accepted — locking yourself out of your own integration is the one failure this feature could plausibly cause.
This is the cheapest protection against the most common way keys leak: a log line, a screenshot, a committed .env. A key bound to your production egress range is useless to anyone who copies it.

​
Security and storage

We store only SHA256(key) — never the raw secret. This means:
  • If you lose your key you must generate a new one; there is no “reveal key” option.
  • A compromised key can be revoked instantly from your profile without affecting other keys.

​
Authentication errors

Every error from the API returns a JSON body in this format:
For details on the 429 error and how to back off correctly, see Rate Limits.