> ## Documentation Index > Fetch the complete documentation index at: https://docs.xo.market/llms.txt > Use this file to discover all available pages before exploring further. # Create API key > Mint a new API key for the wallet that signed the L1 ClobAuth headers. Caller is rate-limited to `MAX_KEYS_PER_USER` total keys; further calls return 400 `"api key limit reached"`. ## OpenAPI ````yaml /api-reference/openapi.yaml post /auth/api-key openapi: 3.0.3 info: title: XO Orderbook API description: | Public REST surface of the XO CLOB API. XO mainnet chain id is `3223`. The EIP-712 order domain is `XO Market CLOB` with `verifyingContract` set to the [CTF Exchange](/) address. See [Smart accounts](../guides/smart-accounts) for the smart-account identity model and ERC-1271 order signing. Wire conventions: * Prices are trimmed decimal strings (e.g. `"0.5"`, `"0.555"`). * Sizes are decimal-string integers in human shares. * Timestamps in trade and book responses are stringified Unix seconds / milliseconds (the SDK uses `TimestampSeconds` / `TimestampMilliSeconds`). * Token IDs are decimal U256 strings; condition IDs are `0x`-prefixed 32-byte hex. version: 1.0.0 contact: name: XO Market url: https://beta.xo.market servers: - url: https://orderbooks.xo.market description: Mainnet (XO chain id 3223) security: [] tags: - name: Authentication description: >- Create and manage API keys. The L1 ClobAuth EIP-712 flow mints HMAC credentials that authenticate every other private request. - name: Market Data description: >- Public reads for books, prices, midpoints, spreads, last trades, and price history. Also includes server time and per-token configuration. - name: Markets description: >- Discovery for tradable markets, including pagination and SDK-compatible simplified shapes. - name: Trade description: Place, cancel, and inspect orders and trades for the authenticated maker. - name: Account description: Maker balance, allowance, positions, and claimable settled positions. paths: /auth/api-key: post: tags: - Authentication summary: Create API key description: | Mint a new API key for the wallet that signed the L1 ClobAuth headers. Caller is rate-limited to `MAX_KEYS_PER_USER` total keys; further calls return 400 `"api key limit reached"`. responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/ApiKeyTriplet' example: apiKey: 7a3f9c1d-8b2e-4a5c-9d1e-2f3a4b5c6d7e secret: dGhpcy1pcy1hbi1leGFtcGxlLWhtYWMtc2VjcmV0LWtleS1iYXNlNjQ= passphrase: 9f3a2b1c4d5e6f708192a3b4c5d6e7f8 '400': $ref: '#/components/responses/Error400' '401': $ref: '#/components/responses/Error401' security: - L1ClobAuth: [] x-codeSamples: - lang: Rust label: xo-orderbook-client-rs source: > use alloy::signers::local::LocalSigner; use xo_orderbook_client::orderbook::{Client, Config}; let signer = LocalSigner::from_bytes(&std::env::var("XO_PRIVATE_KEY")?.parse()?)?; let client = Client::new("https://orderbooks.xo.market", Config::default())?; let creds = client.create_api_key(&signer).await?; // creds: { api_key (UUID), secret (base64 HMAC), passphrase } // Store all three — secret + passphrase are not returned again. // For typical use, prefer `create_or_derive_api_key` — it idempotently // returns existing creds if a key already exists for this wallet: let creds = client.create_or_derive_api_key(&signer).await?; components: schemas: ApiKeyTriplet: type: object description: | camelCase wire keys per CLOB SDK contract. **The triplet is the full credential** — the secret/passphrase are never returned again. Store them on receipt. required: - apiKey - secret - passphrase properties: apiKey: type: string format: uuid description: UUIDv4 — sent as `POLY_API_KEY` header on every L2 HMAC request. secret: type: string description: | Base64-encoded HMAC secret. Used to sign the request canonical string; never sent on the wire after creation. passphrase: type: string description: | Sent as `POLY_PASSPHRASE` header. Distinct from the secret — both must match for the request to authenticate. ErrorResponse: type: object required: - error properties: error: type: string responses: Error400: description: | Validation failure. The body is always `{"error": ""}`. The message is the verbatim string the gateway emits (callers may substring-match on stable prefixes like `"invalid token_id"`, `"duplicate order"`, `"post-only order"`). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalid_token_id: summary: malformed token_id query value: error: 'invalid token_id: invalid digit found in string' invalid_json_body: summary: request body is not JSON value: error: 'invalid JSON body: expected value at line 1 column 1' duplicate_order: summary: replayed signed order value: error: >- duplicate order: an order with the same signed-payload hash is already resting in this book post_only_would_cross: summary: post-only would take liquidity value: error: post-only order would cross resting liquidity post_only_invalid_tif: summary: postOnly with FAK or FOK value: error: postOnly orders must use orderType GTC or GTD Error401: description: | Authentication failure. L1 ClobAuth (wallet) or L2 HMAC (API key) headers were missing, malformed, expired, or did not match the requested resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: l1_required: summary: L1 ClobAuth headers missing value: error: L1 ClobAuth headers required l2_required: summary: HMAC credentials missing value: error: HMAC L2 credentials required address_mismatch: summary: L1-recovered address does not match request value: error: L1 auth address does not match request address securitySchemes: L1ClobAuth: type: apiKey in: header name: XO_ADDRESS description: >- L1 ClobAuth EIP-712 wallet signature. See [Authentication](/api-reference/authentication). ````