Key Management

Rotate and revoke MyStocks Partner API keys and manage scoped read-only data keys, including one-time credential responses and immediate suspension behavior.

Rotate, revoke, and manage scoped read-only data keys. Production revoke uses a Firebase ID token — not the compromised key — while sandbox key-management calls use the sandbox key.

Choose the correct credential lifecycle

Sandbox keys, production API credentials and installation licenses serve different purposes. Hosted approval does not issue or renew an installation license; installation activation does not approve Hosted Live. Data keys and OAuth tokens inherit applicable restrictions and cannot bypass blocked Hosted access. See deployment options and workspace access status.

Installation secrets are retrieved once through the authenticated customer workspace, never sent in notification email. Lost or expired retrieval offers need replacement; renewal and revocation follow OnPrem activation. Keep the installation private identity across approved key changes and restarts.

Rotate a key

Generate a new pk_live_ key. The old key is suspended immediately. Webhooks, sub-accounts, wallet, holdings, and audit history remain attached to the same stable partner identity; no records are copied or migrated. A key.rotated audit event is logged.

Update all services with the new key before discarding the response — the old key is suspended immediately and the new key is shown only once. Data keys (pk_data_) are unaffected by rotation.

POST

/api-keys/rotate

Rotate API key

Full endpoint documentation

Sandbox availablecreateRotate

Issues a new primary API key and immediately suspends the current credential. Partner data remains attached to the same stable partner identity. The new key is returned once in newApiKey; store it securely before closing the response. There is no overlap window.

Parameters

This endpoint has no path or query parameters.

Headers

AuthorizationstringRequired

Bearer sk_sandbox_<your_key> for sandbox requests.

Idempotency-KeystringheaderRequired

Unique string that makes write calls safe to retry on network failure. Required for money movement, trading, KYC, subscriptions, and webhook creation. Deduplicated for 24 hours -- duplicate keys return the cached response. HTTP 409 if a concurrent request with the same key is still in progress.

Example: dep_user42_1743152580

Request body

confirmtrueRequired

Explicit acknowledgement that the current key will stop working immediately.

Response fields

messagestring

newApiKeystring

New primary API key. Store immediately — shown once.

oldApiKeystring

Masked form of the credential that was suspended.

notestring

Response codes

200Key rotated.

Request reference

Sandbox available

Use the API Tester for write requests, including request bodies and idempotency keys.

https://mystocks.africa/api/sandbox/v1/partner/api-keys/rotate

Open in API Tester API Reference

Response schema

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    },
    "newApiKey": {
      "type": "string",
      "description": "New primary API key. Store immediately — shown once."
    },
    "oldApiKey": {
      "type": "string",
      "description": "Masked form of the credential that was suspended."
    },
    "note": {
      "type": "string"
    }
  }
}

curl -X POST 'https://mystocks.africa/api/sandbox/v1/partner/api-keys/rotate' \
  -H "Authorization: Bearer $MYSTOCKS_SANDBOX_API_KEY" \
  -H "Idempotency-Key: YOUR_UNIQUE_REQUEST_ID" \
  -H "Content-Type: application/json" \
  -d '{
  "confirm": true
}'

Revoke a key

Permanently revoke a partner API key. This action cannot be undone. A new key must be issued by MyStocks operations. This endpoint uses a Firebase ID token (Authorization: Bearer <firebase-id-token>), not a partner key, so it remains callable even after a key compromise. A key.revoked audit event is logged.

POST

/api-keys/revoke

Revoke API key

Full endpoint documentation

Sandbox unsupportedPortal sign-in requiredcreateRevoke

Permanently revokes a specific API key. Use this to invalidate a compromised key immediately. If you revoke your only active key, you must contact support to restore access.

Parameters

This endpoint has no path or query parameters.

Headers

AuthorizationstringRequired

Bearer Firebase ID token from your partner portal session.

Idempotency-KeystringheaderRequired

Example: dep_user42_1743152580

Request body

apiKeystringRequired

The pk_live_ key to permanently revoke. Must belong to your account.

Example: "pk_live_a1b2c3d4e5f6..."

Response fields

messagestring

Example: "API key revoked."

apiKeystring

Masked form of the revoked credential.

Response codes

200Key revoked.

404Key not found or does not belong to this account.

Request reference

Sandbox unsupported

This operation requires a partner portal session. Follow the authentication guide.

https://mystocks.africa/api/v1/partner/api-keys/revoke

API Reference Authentication guide

Response schema

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string",
      "example": "API key revoked."
    },
    "apiKey": {
      "type": "string",
      "description": "Masked form of the revoked credential."
    }
  }
}

curl -X POST 'https://mystocks.africa/api/v1/partner/api-keys/revoke' \
  -H "Authorization: Bearer $FIREBASE_ID_TOKEN" \
  -H "Idempotency-Key: YOUR_UNIQUE_REQUEST_ID" \
  -H "Content-Type: application/json" \
  -d '{
  "apiKey": "pk_live_a1b2c3..."
}'

Data key

Create, fetch, or delete a read-only pk_data_ key for market-data access (no trading, funds, or PII). For production apps, proxy through your backend rather than embedding the key in client bundles. Only one data key exists per partner at a time — creating a new one replaces the previous. GET returns a masked registry identifier in dataKey (not a usable credential) plus keyId; dataKey is null when no key exists. The full usable key is only shown on POST. See Authentication for the allowed endpoint list.

curl -X POST "https://mystocks.africa/api/v1/partner/api-keys/data-key" \
  -H "Authorization: Bearer pk_live_<key>" \
  -H "Idempotency-Key: create-data-key-2026-08-10"

DELETE

/api-keys/data-key

Revoke data API key

Full endpoint documentation

Sandbox unsupporteddeleteDataKey

Permanently revokes the data API key. Market data endpoints will return 401 until a new key is issued.

Parameters

This endpoint has no path or query parameters.

Headers

AuthorizationstringRequired

Bearer sk_sandbox_<your_key> for sandbox requests.

Idempotency-KeystringheaderRequired

Example: dep_user42_1743152580

Response fields

messagestring

Example: "Data key revoked."

Response codes

200Data key revoked.

Request reference

Sandbox unsupported

Use the API Tester for write requests, including request bodies and idempotency keys.

https://mystocks.africa/api/v1/partner/api-keys/data-key

Open in API Tester API Reference

Response schema

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string",
      "example": "Data key revoked."
    }
  }
}

curl -X DELETE 'https://mystocks.africa/api/v1/partner/api-keys/data-key' \
  -H "Authorization: Bearer $MYSTOCKS_API_KEY" \
  -H "Idempotency-Key: YOUR_UNIQUE_REQUEST_ID"

Key Management

Choose the correct credential lifecycle

Rotate a key

Parameters

Headers

Request body

Response fields

Response codes

Revoke a key

Parameters

Headers

Request body

Response fields

Response codes

Data key

Parameters

Headers

Response fields

Response codes

On this page