API keys - Tradara

Firm API keys are the long-lived credentials your backend uses to call Tradara. Each key is scoped to a single firm and an optional list of permission slugs. Key prefixes:

Prefix	Environment
`tdr_live_`	Production
`tdr_test_`	Sandbox

The full secret is only returned once, in the response to Create key. Tradara never returns it again. Store it in a secret manager immediately.

Endpoints

Method	Path	Page
`GET`	`/v1/firm-control/api-keys`	List keys
`POST`	`/v1/firm-control/api-keys`	Create key
`POST`	`/v1/firm-control/api-keys/revoke`	Revoke key

Best practices

Issue one key per environment per integration. Never reuse a production key in CI.
Constrain permissions to the smallest set the integration needs.
Rotate keys at least every 90 days. Revoke immediately on staff offboarding.
Monitor Request logs for unexpected key usage.