# API Keys & HMAC Auth

Keys that prove themselves on every call — per-client, HMAC-SHA256 over body and timestamp.

Every API call carries an HMAC-SHA256 signature over its body and a timestamp, so a replayed or
tampered request is rejected before it reaches business logic. Creating or changing a key is
itself an approval-gated action, and the key that authenticates a call never signs a transaction —
a signature needs an MPC share.

## A bearer token is a standing invitation

- **Signed, not bearer** — each call carries an HMAC-SHA256 signature over its body and a
  timestamp, and a replayed or tampered request never reaches business logic.
- **Key creation is governed** — creating or changing a key is one of the 26 approval-gated action
  types; it does not complete because someone clicked it.
- **Authentication is not signing** — a key authenticates a caller. Moving funds needs an MPC share
  and a policy decision, so a stolen key cannot sign on its own.

## Bounded by role and policy

Keys are per client and carry a role, and the policy engine applies to whatever they raise: below
your threshold flows proceed, above it the request waits for people exactly as a dashboard request
would. IP whitelisting is offered alongside as a platform access control.

- Idempotency keys on transaction creation, so a retry cannot double-spend.
- An explicit version header pins your integration while defaults move on.
- Creating or changing a key is recorded like any other sensitive change.
- API request statistics are retained on a rolling window of roughly 90 days.

API requests are included from Standard — Entry runs on the dashboard and the mobile co-signer.

## FAQ

**Does an API key bypass policy?**
No. It is bounded by its role and by the policy engine; above your threshold the request waits for
people, whichever surface raised it.

**What can a stolen key do?**
Not sign. A signature needs an MPC share held by a co-signer, and the policy engine still applies
to anything the key raises.

## Related

- [API Signer](/features/api-signer)
- [Dashboard + API](/features/dashboard-and-api)
- [Roles & Permissions](/features/roles-and-permissions)
- [Audit Trail](/features/audit-trail)