API key

API key is the string that identifies your panel account on every API request, and on the common convention it travels in the request body rather than in a header.

There is no login session to keep alive and no second factor. Every request carries the key and an action, and the key alone says whose account is acting. That is what makes the interface simple to build against, and it is what makes the key worth exactly as much as the balance behind it: anyone holding it can place orders, spend your funds and read your order history as freely as you can.

Because it sits in the request body, it has to be sent by something you control, which in practice means a server. A key placed in browser code, in a mobile app bundle or in a public repository is readable by anyone who looks, and people do look for them. Keep it in a configuration file or an environment variable outside the code, hand a developer a key you can throw away rather than your only one, and never paste it into a support ticket or a screenshot.

Most panels let you regenerate the key from the account settings, which invalidates the old one at once. Do that when a key may have been exposed, when someone who held it stops working with you, and when a piece of integration work is finished. Regenerating breaks every script still using the old value, so plan the change rather than discovering it through orders that quietly stop being placed.

One key, every action

There is no permission level attached to it. The common convention gives an account one key with no read-only variant and no way to limit it to certain actions or services, so a key handed over for reporting can place orders just as easily as yours can.