API keys

An API key is the simplest credential. It looks like wg_ followed by 42 characters, it belongs to one wallet, and it does not expire.

Create oneCopy Anchor Link

Use itCopy Anchor Link

Every request carries it as a bearer token:

curl -H "Authorization: Bearer wg_…" \
  https://api.walletguide.com/wallets

The CLI reads it from the environment instead:

export WALLETGUIDE_API_KEY=wg_…
walletguide assets list

The MCP endpoint takes the same bearer token, for a client that cannot open a browser to sign in.

What it can reachCopy Anchor Link

One wallet, with the permissions the key was given. A new key is read-only (the viewer preset); give it the editor preset to let it change the wallet's data, or pick areas one by one, for example read everything but write only transactions. Nobody can give a key more than they hold themselves. Keys made before permissions existed keep the editor preset.

Whatever its permissions, a key never manages the wallet: it cannot invite or remove people, mint other keys, connect a bank, rename the wallet, change its base currency or delete it, Those are decisions a person makes in their own session. Every operation in the endpoint reference lists the permissions it needs. Ask GET /wallets and it answers with that one wallet, which is how the CLI and the MCP tools resolve it without being told.

A key cannot sign in, cannot read another wallet, and cannot touch account settings. Anything about a person rather than a wallet needs a session or an OAuth grant.

Keeping itCopy Anchor Link

Treat it like a password, because that is what it is. A leaked key reads everything its permissions allow, and a key that may write transactions can delete them. Give each key the least it needs.

• Keep it in an environment variable or a secret manager, never in the repository
• One key per thing that uses it, so revoking one does not break the others
• Delete a key the moment whatever used it is gone

Revoke in the same place you created it. Deletion takes effect immediately.