DeepSafe
User Manual
Updates & Announcements
User Manual
Updates & Announcements
  1. Developer
  • About DeepSafe
  • Quick Start
    • Core Concepts
    • Account Security Principles
    • Getting Started
  • Using DeepSafe
    • Accounts & Teams
      • Teams & Members
      • Decision Mode
      • Roles & Permissions
      • Account & Security Settings
    • Wallets & Transactions
      • Wallets & Assets
      • Key Shards
      • Sending Assets
      • Receiving Assets
      • Transaction Records
      • Gas Service
    • Security
      • Approval Workbench
      • Address Whitelist
      • Approval Nodes
      • Policy Engine
      • Audit Log
    • Developer
      • API Key Management
  1. Developer

API Key Management

Overview#

API Keys integrate DeepSafe capabilities into your own business systems. A business system calls the API using an API Key, and its actions remain subject to your Team's policies and permissions.
Creating or editing an API Key takes effect only after approval under your Team's Decision Mode.
image.png

Configuration#

ItemNotes
NameIdentifies what the API Key is for, up to 30 characters
Enable signingWhen enabled, a Webhook address is required for callbacks
Public keyRSA public key; only 4096-bit keys are supported. Paste it or upload a PEM file
IP allowlistSource IPs permitted to call the API, separated by commas
PermissionsThe scope of operations the API Key can perform
Generate the key pair in your own environment. Keep the private key secure and do not share it with any third party, including DeepSafe.

Status#

The list shows each API Key's review status, validity status, and signing machine status, reflecting its approval progress, whether it is currently usable, and whether its signing capability is ready. An API Key can call the API only when all of these are in order.

How API Keys relate to policies and permissions#

An API Key is not a channel that bypasses your Team's rules. It remains subject to two layers of control.
As a policy initiator condition. A policy's initiator can be set to specific API Keys or to all API Keys. Choosing all includes API Keys added in future that hold the initiate-transactions permission.
As a participant in Approval Nodes. An Approval Node can include API Keys in its approver scope, configured the same way as Team members.
Subject to whitelist transfer restrictions. Your Team can enable the API Transfer Restriction separately; when it is on, transfers initiated through the API can only go to whitelist addresses. This toggle is independent of the Manual Transfer Restriction.

Things to note#

The IP allowlist is an important safeguard. Enter only the egress IPs your business system actually uses; avoid leaving it empty or specifying an overly broad range.
Configure API Key permissions on a least-privilege basis. If a business system only needs to read data, do not grant transaction-related permissions.
Delete API Keys you no longer use. Credentials that persist without an owner are a common source of risk.
Modified at 2026-08-26 02:51:05
Previous
Audit Log
Built with