How to create API keys on Usko safely
What an API key is, when you genuinely need one, and how to create and restrict it without putting your funds at risk.
Do you actually need one?
An API key lets a program reach your account without your password. If you only use Usko through the website or the app, you do not need an API key and should not create one. Every key you create is another way into your account.
There is one situation where the answer is always no: if somebody asks you for a key, or offers to “trade for you” if you give them one, that is a scam. There are no exceptions to this.
What you need first
- A verified account with two-factor authentication enabled.
- A specific tool you are running yourself that requires a key.
- Somewhere secure to store the secret — a password manager, not a note on your desktop.
Step 1 — Open the API keys page
Select your profile icon, then API keys in your account settings.
Step 2 — Create a key with a clear name
Select Create and name the key after the thing that will use it. When you have three keys in a year's time, “my bot” will not be a helpful label; the name of the actual tool will be.
Step 3 — Grant the minimum permissions
Each key carries its own permissions. Grant only what the tool genuinely needs:
- Read — view balances and history. Enough for a portfolio tracker.
- Trade — place and cancel orders. Only for something that actually trades.
- Withdraw — move funds out. Almost nothing needs this. Leave it off unless you have a very specific reason and understand exactly what you are enabling.
Step 4 — Restrict it by IP address if you can
If the option is available and your tool runs from a fixed address, restrict the key to that address. A stolen key that only works from one machine is far less dangerous.
Step 5 — Save the secret now
The secret is shown once, at creation. Copy it straight into your password manager. If you lose it, you cannot recover it — you delete the key and create another.
Step 6 — Handle it like a password
- Never paste a key into a website, a chat, an email or a support ticket.
- Never commit one to a code repository, public or private.
- Never share it with a person or a service that promises to trade on your behalf.
Step 7 — Review and delete
Come back to the API keys page occasionally and delete anything you no longer use. If you suspect a key has leaked, delete it immediately — that revokes access at once — then create a fresh one for the tool.
A note on building against the API
There is an endpoint reference on the site and you can explore it. Please read the current status published there before you depend on it for anything automated.