# API keys and scopes

> One name, API key, for every key a program sends. A key carries a scope: the products it opens. The prefix names the scope, so a key pasted into a chart plugin is visibly not one that spends Lab credits.

Source: https://firmtape.com/docs/developers/keys

One name, **API key**, for every key a program sends. A key carries a **scope**: the products it opens. The prefix names the scope, so a key pasted into a chart plugin is visibly not one that spends Lab credits.

Send it as `Authorization: Bearer <key>`.

| Scope | Prefix | Opens | Plan | Made on |
| --- | --- | --- | --- | --- |
| `live` | `ftpl_` | The levels API (`/api/v1`), the platform integrations | LIVE | [Account, Integrations](https://firmtape.com/account#integrations) |
| `lab` | `labk_` | The LAB API (`/api/lab`, `/api/struct`), the MCP server's `lab_` tools | LAB | [Account, LAB](https://firmtape.com/account#lab) |
| `dataset` | `labk_` | The DATASET files (`/snapshots/<day>.json.gz`) and levels API history older than 90 days | DATASET | [Account, LAB](https://firmtape.com/account#lab) |
| `orders` | `ordk_` | The Orders API (`/orders/api`), the POSITIONS API (`/api/positions`), the Orders MCP server (`/orders/mcp`) | ORDERS | [Account, Orders](https://firmtape.com/account#orders-keys) |
| `geo` | `gk_` | The Geo API (`geo.firmtape.com/v1`), the Geo MCP server | GEO | [Account, Geo, Keys](https://firmtape.com/account#geo-keys) |

## Keeping keys

- A key is shown once, when it is made. Store it like a password.
- Revoke a key on the page it was made on. A revoked key, or a plan that ended, stops working within a minute.
- Bearer requests need no cookie and no CSRF token.
- Finished sessions on the site and `GET /api/v1/symbols` need no key at all.

## Each scope

### `live` (`ftpl_`)

- Read only: it cannot run LAB or spend credits.
- One key per machine: a `live` key answers from at most 3 client addresses in an hour.
- A `lab` key also opens the levels API, for plugins set up with one before `ftpl_` keys existed.

### `lab` (`labk_`)

- Jobs spend the account's LAB credits.
- An assistant can sign in through OAuth instead and holds the same scope.

### `dataset` (`labk_`)

- Today the dataset opens with the account's `lab` key, the same key as the `lab` scope; no LAB purchase is needed.
- Planned: the dataset gets a key of its own (see Versioning, Planned).

### `orders` (`ordk_`)

- On the Orders API and Team plans.
- Calls are counted per account, not per key.

### `geo` (`gk_`)

- On the Geo API and Team plans.
- A plan allows a number of keys; after a move to a smaller plan the oldest keys keep working.

## The key in the address (legacy)

Legacy: `?key=<key>` in the address works on the levels API for platforms that cannot send headers (Sierra Chart). A key in an address can end up in logs and history: give each such tool its own key and revoke it if the address was ever shared. Every other API takes the header only.

## The signing secret

`whsec_` What your receiver verifies a webhook with. FirmTape sends with it; you never send it to FirmTape. Shown on the account page beside the webhook, rotated there.