Skip to content

Create and manage API keys

The Hex Safe REST API lets your own systems use Hex Safe without the web app, for example to read balances or initiate withdrawals. Each API key belongs to the user who creates it and has exactly the same access as that user.

New to the API? The API quick start takes you from a key pair to your first signed call. For the full endpoint reference, see the Hex Safe API documentation.

Before you start

You need a certificate signing request (CSR) in PEM format.

  1. Generate an RSA or ECDSA key pair with OpenSSL.
  2. Use the key pair to create a CSR.
  3. Keep the private key secret. You use it to sign every API request, and Hex Trust never sees it.

The API documentation's API Key Management page has the exact OpenSSL commands.

Try it: interactive walkthrough

Click the highlighted area on each screen to move through the steps. All names, balances and addresses are demo data.

Create an API key

  1. Go to Settings › API Key and click Create API Key.
  2. Enter an API Key Name you'll recognise later, for example the system that will use it.
  3. Paste your CSR into Paste CSR below.
  4. Under Expire after, choose 30, 90, 180, 240 or 365 days. You can tick Set this API key to Never Expire instead, but keys that expire are safer.
  5. Click Get API Key.

The key appears in the list with its name, created date and expiry date. API keys always start with hsk_. Use the eye icon to reveal the key, or the copy icon to copy it.

Limits

  • Each user can have up to 5 API keys.
  • If you send too many requests, the API responds with HTTP 429. See Errors and rate limits.

Keep your keys safe

  • Never share API keys or private keys, and never put them in code repositories or chat messages.
  • Give API users only the roles they need. Because a key has the same access as its user, the API documentation recommends two separate API users:
    • a viewer, for read-only actions;
    • a signer, for transactions.
  • Prefer keys that expire, and replace them before they do.