Understanding API Keys and Permissions
Learn how GroveX API keys work, why permissions matter, how to protect API secrets and when to use IP restrictions.
What is an API key?
An API key is a credential used by software to interact with supported GroveX account or trading functions programmatically.
API access can be useful for:
- trading applications;
- portfolio tools;
- automated systems;
- reporting;
- approved integrations.
API credentials should be treated as sensitive security credentials.
API key versus API secret
An API credential normally includes an identifier and a secret component.
The secret should be protected in the same way you would protect a password.
Do not publish it in:
- screenshots;
- source-code repositories;
- support tickets;
- chat messages;
- frontend browser code;
- public configuration files.
Permissions
API keys can be limited by permissions.
The exact permissions available depend on the GroveX API and account configuration.
A key should receive only the permissions required for its intended purpose.
This is known as the principle of least privilege.
For example, a reporting integration should not receive trading permissions if it does not need to place orders.
Separate keys for separate systems
Avoid using one powerful API key for every application.
Separate keys make it easier to:
- limit permissions;
- identify which system performed an action;
- revoke one integration without breaking others;
- rotate credentials safely.
IP restrictions
Where supported, restrict an API key to the known public IP addresses used by your server or trading system.
IP restrictions can reduce risk if the API credentials are exposed.
Do not use an unrestricted key simply because it is easier to configure.
Store secrets server-side
API secrets should be stored in an appropriate server-side secret manager or protected environment.
Do not place a secret in a website's client-side JavaScript because users and attackers may be able to retrieve it from the browser.
If an API secret is exposed
Treat it as compromised.
- Disable or delete the affected key.
- Create a replacement key if required.
- Apply minimum necessary permissions.
- Reapply IP restrictions.
- Update the integration securely.
- Review recent API and trading activity.
Do not continue using a known-exposed credential.
Review keys regularly
Remove API keys that are:
- no longer used;
- associated with retired systems;
- created for temporary testing;
- not recognized.
Use descriptive labels where available so you know which application owns each key.
Account security still matters
An API key does not replace normal GroveX account security.
Protect the main account with a unique password and two-factor authentication.
Read GroveX Account Security Guide.
Need implementation help?
Never include an API secret in a Support request.
You can provide a key label, non-secret identifier, error message and relevant request details without disclosing the secret itself.
Submit a support request: https://grovexcom-help.freshdesk.com/support/tickets/new