Developers
Authentication
Authenticate requests with an API key in the X-API-Key header.
Public endpoints (tokens, quotes and stats) work without a key. Account endpoints require one. Sending a key on a public request is optional and gives it the higher per-key rate limit.
Sending the key
Pass the key in the X-API-Key header. Keys in query strings are rejected, so they never end up in logs or browser history.
GET /api/v1/me HTTP/1.1
Host: privy.ac
X-API-Key: pvy_live_...Key format
Keys start with pvy_live_ followed by 43 random characters. Privy stores only a SHA-256 hash, so a lost key cannot be recovered; rotate it instead.
Scopes
| Scope | Grants |
|---|---|
read:public | Tokens, quotes and platform stats. |
read:account | Your account, holdings, positions, activity, points and trades. |
Authentication errors
| Status | Code | Meaning |
|---|---|---|
| 401 | MISSING_API_KEY | An account endpoint was called without a key. |
| 401 | INVALID_API_KEY | The key is malformed, unknown or revoked. |
| 403 | INSUFFICIENT_SCOPE | The key lacks the scope the endpoint needs. |