AI agents and API

API keys and session keys

Give each AI agent exactly the access it needs. Keys scoped to read, paper or live, to projects and tools, with an expiry and daily spend caps, rotated with a grace period and revoked in one click.

View as Markdown

API keys#

Make a key on the AI & API page. It's shown once (fwb_at_…); a client sends it as Authorization: Bearer fwb_at_…. Each key has:

Setting	Limits
Access	`read` (look only), `paper` (trade on paper) or `live` (trade real money)
Projects	Only these projects
Tools	Only these tools
Expiry	An hour, a day, a week, a month, or never
Spend caps	ETH a day, and signatures a day, across everything the key does

Session keys for sub-agents#

An agent can make session keys for agents it runs: narrower, shorter-lived keys that can never have more than their parent. Revoking a key revokes every key made from it, and a key's spending counts against its parents' caps too.

Terminal

ftw-trade keys create scout --access paper --projects p_1 --expires 1d --eth-per-day 0.05 --save-as scout
ftw-trade keys list
ftw-trade keys rotate          # a new secret, the old one valid for a grace period
ftw-trade keys revoke <id>

OAuth connections#

Apps connected by OAuth (Claude, ChatGPT, Claude Code, Codex) appear on the same page with their live-trading permission, and can be revoked there.

If a key leaks#

Revoke it on the AI & API page. Account → Security → Sign out everywhere else also revokes every API key at once.