Skip to main content
This walk-through uses the Data API because it is included in the Free plan and needs no funded account. The same credential scheme (HMAC) applies to Market Data and the Trade API; only the endpoint and scope change.

1. Set up access

  1. Create an account or log in.
  2. Open Endpoints and set up the Data API endpoint. One endpoint per product per organisation.
  3. Under its API keys tab, click Create credential. The key carries analytics.read. Save the secret when it is shown; it is not displayed again.
  4. Set BRAVADO_API_KEY and BRAVADO_API_SECRET in your server environment. Never put the secret in browser code, a URL or source control.

2. Sign and send a request

Every request carries three headers: the public key, a millisecond timestamp and an HMAC-SHA256 signature of timestamp\nMETHOD\npath\nsha256(body). For a GET the body hash is the empty-body constant. Save the file, then run it with your environment variables set.
A 200 returns the 30-day PnL leaderboard. The call costs 1 API credit. Query parameters are part of the signed path when present; the helpers on request signing examples canonicalise them for you, so start from those for anything beyond a bare path.

3. Check your usage

Open Usage in the same Console organisation that owns the key. The call appears under the Data API with its credit. Usage is batched; allow about a minute, then refresh.

4. Pick your next product

  • Data API: the trader analytics reference and Combos Data use this same credential.
  • Market Data: set up the Market Data endpoint on a paid plan and follow Live Trades for a signed WebSocket connection. A Data API key does not open streams.
  • Trade API: the Trade quickstart places a first order with a Trade credential.
  • MCP Server: connect Claude or another client with OAuth, no API key, in MCP Server.

Troubleshooting

  • 401: check the matching key and secret, current millisecond timestamp (within 30 s of server time) and the exact signed path. A Trade or Market Data key is refused here; the Data API needs its own credential.
  • 403: the key lacks analytics.read or the organisation lacks the venue. Creating an endpoint does not grant scopes.
  • 402: the organisation’s credit ceiling is reached. See API credits.
  • 429: rate limit; respect Retry-After.