API keys

Create a Walletguide API key, where it is scoped, what it can do, and how to keep it out of your repository.

An API key is the simplest credential. It looks like wg_ followed by 42 characters, it belongs to one wallet, and it does not expire.

Create one

Open app.walletguide.com and pick the wallet you want the key to reach.

Go to wallet settings, then API keys.

Create a key and copy it. The secret half is shown once and never again, because only its hash is stored.

Use it

Every request carries it as a bearer token:

curl -H "Authorization: Bearer wg_…" \
  https://api.walletguide.com/wallets

The CLI and the MCP server read it from the environment instead:

export WALLETGUIDE_API_KEY=wg_…
walletguide assets list

One wallet, at the role the key was given. An owner key can do anything an owner can, including deleting the wallet; an editor key cannot change membership. Ask GET /wallets and it answers with that one wallet, which is how the CLI and the MCP server discover it without being told.

A key cannot sign in, cannot read another wallet, and cannot touch account settings. Anything about a person rather than a wallet needs a session or an OAuth grant.

Keeping it

Treat it like a password, because that is what it is. A leaked key reads every transaction in that wallet and can delete them.

Keep it in an environment variable or a secret manager, never in the repository
One key per thing that uses it, so revoking one does not break the others
Delete a key the moment whatever used it is gone

Revoke in the same place you created it. Deletion takes effect immediately.

Create one

Use it

What it can reach

Keeping it

On this page