Skip to main content

API keys

API keys authorize server-side clients — bots, backtesters, data collectors — to connect to the relay. They are sent in the Authorization header, which only non-browser clients can set. (Browsers use a ticket instead.)

Creating a key​

Settings → API Keys → Create. Creating a key requires an active subscription and a step-up confirmation. The full key is shown once:

aqk_live_v1_<32 hex chars>_<43 url-safe base64 chars>
  • The middle segment is the key's public id (safe to log for support).
  • The final segment is the secret. It is never stored in plaintext and cannot be recovered — store it securely.

Using a key​

Send it as a bearer token in the Authorization header:

websocat "wss://feed.alphaquick.io/ws?symbol=BTC&channel=tob100&source=combined" \
  -H "Authorization: Bearer aqk_live_v1_…"

The key is header-only by design — never put it in the URL query (query strings leak into logs, history, and referrers).

How authorization works​

On connect, the relay verifies your key with AlphaQuick and receives a short lease describing what you may stream and for how long. The relay revalidates the lease periodically (about every 30 seconds) while you stay connected.

This is why revocation is fast: revoke a key in the app and, at the next revalidation, the relay closes the connection — typically within ~30 seconds. The revalidation does not add latency to your market-data stream; it happens on a separate control path.

Revoking & rotating​

  • Revoke a compromised key immediately in Settings → API Keys. Access stops within ~30 seconds.
  • Rotate by creating a new key, deploying it, then revoking the old one.

Limits​

Each key is subject to per-account, per-key, and per-IP connection limits and a connection-rate limit. See Connection limits.