API keys
Where keys are issued in the app, their shape, and how rotation and revocation work.
Keys are issued in the app by the account's own wallet session; WolfEdge never issues one. Every account tier uses the same keys and the same screen.
Connect your wallet. The key panel only appears once it is.
Press API Keys in the header. On a phone, open the menu and choose Trading API Keys under Developer.
Add a label if you want one, quoting-bot for example, and press Generate key.
Copy the key. It is shown once and cannot be shown again: Cardiv stores a prefix and an HMAC, not the secret.
The panel lists every active key with its prefix, label, creation time and last use, and a Revoke button on each.
The key
usr_ak_a1b2c3d4e5f60718.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxBefore the dot is the lookup prefix, shown in the panel and the handle to quote to support. After the dot is the 256-bit secret. A key is bound to the single party that issued it and to the environment it was issued on.
Rotation and revocation
Up to five keys can be live on an account at once, so a rotation has no gap: issue a new key, move your clients, then revoke the old one. Revocation is per key and immediate. That key answers 401 API_KEY_REVOKED from then on while the others keep working. At the cap, issuing returns 409 MAX_ACTIVE_KEYS until you revoke one.
Listing, issuing and revoking need the app, with your wallet connected. A key cannot manage keys, so a leaked key cannot mint a successor or revoke the others.
If a key leaks
Revoke it in the app. Resting orders are unaffected and cancel as usual.
A leaked signing key is the serious case. It can sign anything and cannot be revoked. Cancel your resting orders and move funds to a new wallet.
Need help
Write to support@wolfedgelabs.com and include your party ID.