Authentication
Pariflow API access requires approved credentials. Keep credentials secret and scoped to the smallest necessary permission set.
This page describes public credential expectations. It does not publish private endpoint secrets, privileged access paths, or operational runbooks.
Credential handling
- Store credentials in environment variables or a secrets manager.
- Never commit API keys, session tokens, private keys, or webhook secrets.
- Rotate credentials when team members leave or access patterns change.
- Use HTTPS for all production traffic.
- Separate development and production credentials.
- Do not expose credentials in browser bundles, logs, screenshots, or client-readable configuration.
Sample credential format
Documentation examples should use safe sample values only:
PARIFLOW_API_KEY=your_key_hereNever replace sample values with a real credential in docs, code comments, issue reports, or public support messages.
Permissions
Credentials may be scoped for read-only market data, user-authorized data, webhook verification, or trading permissions. Trading permissions, where available, should be treated as high-risk and require additional safeguards.
| Scope | Typical use |
|---|---|
| Market data | Read public market metadata, state, and price context where available. |
| User-authorized data | Read account-specific information only after an approved user authorization flow. |
| Webhook verification | Verify event delivery where webhooks are enabled for an approved integration. |
| Trading | Submit trade-related actions only when explicitly approved and controlled. |
Errors
Authentication failures can occur when credentials are missing, expired, revoked, incorrectly scoped, or used from an unapproved environment.
Security posture
If a credential is exposed, assume it is compromised. Revoke or rotate it, review recent usage, and replace any affected deployment configuration before restoring access.
Related: Developer overview