API keys
Generate, scope, and revoke keys from the dashboard.
Generating a key
- Open the dashboard and go to Developer → API Keys.
- Click Create API key, give it a name, choose its permissions and (optionally) an expiry date.
- The secret is shown once. Copy it immediately and store it somewhere safe; it can't be recovered.
Scoping a key
A key holds an explicit list of allowed actions rather than a role. You grant wallet-scoped actions per wallet and a couple of global actions that aren't tied to a wallet; see Permissions & scoping for the full action list. You can only grant actions you hold yourself, and signing actions only on wallets whose key you can access; in the dashboard the rest are disabled.
Source IP allowlist
Optionally restrict a key to a set of source IPs. Provide individual IPv4/IPv6 addresses or CIDR ranges (e.g. 203.0.113.4, 10.0.0.0/24, 2001:db8::/32). A request from any other address is rejected with 401. Leave the list empty to allow any source.
Key format
Keys are prefixed with gv_live_ followed by random characters:
gv_live_8Fz2pQ9rX1...Only a short prefix is ever shown again in the dashboard, so you can recognise a key without revealing it.
Expiry
A key can be created with an expiry date or with no expiry at all. Once a key passes its expiry it stops working and the API returns 401.
Updating & revoking
Edit a key's permissions, wallets, IP allowlist, or expiry at any time, or revoke it; revoked keys stop working immediately. The secret is never re-shown or rotated. For security, keys are created, updated, and revoked only in the dashboard, never through the API.
Verification
Creating, updating, and revoking a key are sensitive actions: the dashboard asks you to re-verify your identity (your authenticator, a passkey, or an emailed code) before the change is applied, and every change is recorded in the company activity log.