Authentication

Every TPX request authenticates with an API key in the X-API-Key header.

curl -X POST https://platform-api.tradepost.co/graphql \
  -H "Content-Type: application/json" \
  -H "X-API-Key: tp_live_your_api_key_here" \
  -d '{ "query": "query { ... }" }'

The header is X-API-Key

Other header names (x-api-token, Authorization) are not read — requests sent with them fail auth exactly like requests with no key at all.

Keys

Environment	Prefix
Production	tp_live_
Sandbox	Coming soon

Generate and manage keys in Terminal under Settings → API Keys. Keys belong to your account — every submission, strategy, and fill created with a key is scoped to the account that owns it.

Handling keys

• Store keys in environment variables or a secret manager, never in code or version control
• Send them only over HTTPS
• Rotate periodically, and immediately if a key may have leaked

Auth failures

A missing or invalid key returns a top-level GraphQL error, not an HTTP status code — the response is HTTP 200 with an errors array:

{
  "data": null,
  "errors": [
    { "message": "Authentication required", "path": ["listOrderSubmissions"] }
  ]
}

Check for top-level errors before reading data. This is distinct from payload-level error { message code } objects, which mean the request authenticated fine and failed for a domain reason — see Overview → Errors.