Skip to main content

​
Base URL

There is one environment. Orders route to the real venues, so a live fill spends real funds. Use paper trading to test without them.

​
Your app ID

Every request that uses an app id carries it in the x-app-id header. Find it in the admin dashboard: pick your app, then open API under Develop. The same page lists your API keys.

​
Allowed origins

Your app’s allowed origins are the sites your browser code runs on. Manage them in the admin dashboard under Domains. Enter bare origins such as https://app.example.com, with no path, query, or wildcard. They are used in three places:
  • A request that sends an Origin header must match one of them, or it gets 403 Origin not allowed for this app. Server requests usually send no Origin and skip this check.
  • A SIWE or SIWS sign-in message names a domain. It must match an allowed origin, or sign-in fails with 401 and code: "unregistered_domain".
  • OAuth and magic-link redirectUrl values must be on an allowed origin.
An app with no allowed origins cannot complete wallet sign-in.

​
Headers

The public API uses the credentials below. Your app ID identifies the integration and is safe to include in browser or mobile code. A user access token authorizes actions for that user. Server API keys are secrets and must stay on your backend. Exception: POST /bot-protection/verify requires both x-app-id and x-app-api-key. See Bot protection. A user JWT on the smart-route quote turns a preview into an executable quote. A sell still requires a signed-in user. referrer is rejected without x-app-api-key. skipQuote and skipBalance are rejected without an x-app-api-key that can write (read_write); a read-only key is refused. That key does not replace x-app-id. Users sign in on the client. Your backend sends that user’s access token on set 2 calls. See Authentication & sessions.

​
App config

GET /app/config is UI config for the app: disabled venues, disabled categories, early access, auth providers, trading mode, and the paper starting balance. Send x-app-id only. The response has no secrets.
Full shape on Get the per-app UI config (disabled venues + categories).

​
Server API keys

Send x-app-api-key from your backend on API-key routes, on POST /bot-protection/verify, and when using per-trade fee overrides, referrals, skipQuote, or skipBalance. You can also send a key with server-side market-data requests to use its rate-limit budget. Keep x-app-id on app and user routes, and keep the user token where required; the key does not replace them.
An API key is a secret. Never put it in browser bundles, source maps, public repositories, or logs.

​
Create a key

In the admin dashboard, pick your app, open API, and create a key. The key is shown once. Store it in your secret manager right away. AGG keeps only a hash and cannot show it again. Keys look like agg_<appId>_<64 hex characters>. The app id is the one embedded in that prefix. A key that is missing, malformed, unknown, revoked, expired, or for another app is rejected with 401 or 403. Unknown and wrong-app keys return the same "Invalid API key" message. Use a read key for reporting and a read_write key for operations that change state. skipQuote and skipBalance require read_write. Manage app members and settings in the admin dashboard. For app-wide reporting, follow Partner admin to read users, balances, orders, and analytics from your backend with this key.

​
Rotate a key

  1. Create a new key.
  2. Deploy your backend with it.
  3. Check traffic moved to it (lastUsedAt in the dashboard).
  4. Revoke the old key. Revoked and expired keys fail at once with 401.

​
Rate limits

A validated key gets its own per-key budget, by default 18,000 requests per minute, and skips browser IP limits. AGG can change a key’s budget on request. Route-specific caps still apply, see Market data API. A limited request returns 429 with a Retry-After header in seconds. See Errors, retries & idempotency.

​
Testing mode

New apps start in testing mode, with two caps: Existing users can always sign in. Past the user cap, POST /auth/verify returns 403 for new users. Past the trade cap, trading calls return 403. Both carry a readable message:
OAuth and magic-link sign-in report the user cap on the redirect URL as a message query parameter with error=testing_user_limit_reached. To lift the caps, sign the partner agreement in the admin dashboard (Go Live). It takes effect at once and cannot be undone from the dashboard. Existing users and trades are kept.