Authentication

Every request to the external API at /api/ext authenticates with an API key and an API secret tied to your trader account. Send both as HTTP headers.

Before you begin

To call the external API, your account must meet both of these requirements:

• The account is a trader account. Admin and payer accounts can't hold API keys.
• The account's plan includes external API access. This covers the Unlimited pack and any enterprise plan with the flag enabled. Otherwise the API returns 403 PLAN_EXTERNAL_API_REQUIRED.

Send credentials

Send both headers on every request:

To verify a key pair, call GET /api/ext/me. It's the simplest authenticated request and returns the trader the credentials belong to.

curl https://api.mytpe.app/api/ext/me \
  -H "X-Api-Key: $MYTPE_API_KEY" \
  -H "X-Api-Secret: $MYTPE_API_SECRET"

{
  "data": {
    "id": "9c1f0e2a-4b6d-4a8e-9f10-2c3d4e5f6a7b",
    "email": "trader@example.com",
    "name": "Boutique Centrale",
    "role": "trader",
    "created_at": "2026-01-12T09:30:00+00:00"
  }
}

Select a workspace

A trader account can own several workspaces, and each workspace is either live or test. To choose which one a request acts on, send the workspace ID in the X-Workspace-Id header:

curl https://api.mytpe.app/api/ext/instances \
  -H "X-Api-Key: $MYTPE_API_KEY" \
  -H "X-Api-Secret: $MYTPE_API_SECRET" \
  -H "X-Workspace-Id: 7f3a1b2c-8d9e-4f01-a2b3-c4d5e6f70819"

If you omit the header, the API uses your earliest live workspace. Requesting a workspace your account can't reach returns 403 WORKSPACE_ACCESS_DENIED.

Test workspaces

A test workspace is an ordinary workspace with live mode turned off. Point X-Workspace-Id at one to run an integration end to end without moving real money: the request routes to the gateway's test credentials, and the data stays isolated from your live workspace.

There is no per-request test flag. The mode follows the workspace you select.

Manage keys

Generate and revoke keys from your dashboard, under Settings → Developers → API keys.

These management endpoints sit outside /api/ext and authenticate with your dashboard session token, not with the API key and secret.

Show key status

curl https://api.mytpe.app/api/trader/api-keys \
  -H "Authorization: Bearer $MYTPE_SESSION_TOKEN"

{
  "data": {
    "api_key": "TRD-8F3C1A9B2D4E5F6071",
    "api_secret": "***",
    "has_key": true
  }
}

Generate a key pair

curl -X POST https://api.mytpe.app/api/trader/api-keys \
  -H "Authorization: Bearer $MYTPE_SESSION_TOKEN"

{
  "data": {
    "api_key": "TRD-8F3C1A9B2D4E5F6071",
    "api_secret": "SEC-a1b2c3d4e5f6071829304a5b6c7d8e9f"
  },
  "meta": {
    "message": "API key generated."
  }
}

Generating a pair invalidates the previous one immediately. Any integration still sending the old credentials starts receiving 401 INVALID_API_CREDENTIALS.

Revoke the key pair

curl -X DELETE https://api.mytpe.app/api/trader/api-keys \
  -H "Authorization: Bearer $MYTPE_SESSION_TOKEN"

{
  "meta": {
    "message": "API key revoked."
  }
}

Authentication errors

{
  "errors": [
    {
      "status": "401",
      "code": "INVALID_API_CREDENTIALS",
      "title": "Invalid API credentials.",
      "detail": null,
      "meta": []
    }
  ]
}

The distinction between the two 401 codes tells you where to look. MISSING_API_CREDENTIALS means a header never arrived, so check how your HTTP client sets headers. INVALID_API_CREDENTIALS means both headers arrived and the lookup failed, so check the values themselves.

For the full error envelope, see Responses.

Webhook signatures

Authenticating incoming calls from MyTPE to your server works differently. MyTPE signs each delivery with the webhook's own secret in the X-Mytpe-Signature header. See Webhooks.