Skip to main content

Authentication

Every TRONAgg API request requires an API key in the X-API-Key header:

X-API-Key: ta_your_key_here

API keys are tied to your TRONAgg account. All purchases are deducted from the account balance associated with that key.

Creating an API Key​

  1. Log in to the TRONAgg Dashboard
  2. Click API Keys in the sidebar
  3. Click Create API Key
  4. Enter a descriptive name (e.g., "Production Bot", "Testing")
  5. Optionally open Restrict to specific IPs and enter the public IP addresses or CIDR ranges that will use the key. Leave it empty for unrestricted IP access.
  6. Click Create
  7. Copy the key immediately -- it is displayed only once
danger

The full API key is shown only at creation time. If you lose it, revoke the key and create a new one.

Limits​

  • Maximum 5 API keys per account
  • Each key has independent access to your full account balance
  • Revoking one key does not affect others

Key Format​

  • Prefix: ta_ (identifies TRONAgg keys at a glance)
  • Body: 43 characters of URL-safe random data
  • Total length: 46 characters

Example: ta_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789-_abcde

Only the SHA-256 hash of the key is stored on our servers. The full key exists only in your possession.

Key Management​

Optional IP Allowlist​

IP restrictions are off by default. Existing API keys keep working from any IP until you explicitly save a non-empty allowlist for that key.

In API keys, click IP access beside a key to edit its list without replacing the key. You can enter up to 50 IPv4 addresses, IPv6 addresses, or CIDR ranges:

203.0.113.7
2001:db8::1
198.51.100.0/24

Paste one entry per line, or separate entries with commas, semicolons, or spaces. Duplicates are removed. CIDRs must use the network address: use 198.51.100.0/24, not 198.51.100.7/24. Hostnames and port numbers are not accepted.

Add my current IP fills in your browser's address. Your server, bot, VPN or hosted MCP connector may use a different public IP; allow the outgoing address of the system that actually sends the API requests.

After saving, requests from outside the list receive 403 ip_not_allowed. Your workspace login is unaffected. To remove restrictions, clear the list and click Remove restriction. The API key itself stays the same.

Revoking a Key​

If a key is compromised or no longer needed:

  1. Go to API Keys in the Dashboard
  2. Find the key you want to revoke
  3. Click the Revoke button
  4. Confirm the action

Revoked keys stop working immediately. Revocation cannot be undone.

Best Practices​

  • Name keys descriptively -- "Prod Trading Bot" is better than "Key 1"
  • Use separate keys for different applications or environments
  • Revoke unused keys promptly
  • Rotate keys periodically as a security measure

Storing Keys Securely​

Never hardcode API keys in source code. Use environment variables instead:

export TRONAGG_API_KEY="ta_your_key_here"

Or use a .env file (excluded from git):

.env
TRONAGG_API_KEY=ta_your_key_here
app.py
from dotenv import load_dotenv
import os

load_dotenv()
API_KEY = os.environ["TRONAGG_API_KEY"]

Error Responses​

StatusMeaning
401 UnauthorizedAPI key is missing, invalid, or revoked (plain-string detail, e.g. "Invalid API key")
403 ForbiddenThe account is blocked (plain-string detail: "Account is blocked"), or the request's source IP is outside this key's allowlist (detail.error: "ip_not_allowed")
429 Too Many RequestsMore than 1,000 requests per minute for your account, across all of its keys and workspace sessions. Wait the number of seconds in the Retry-After header

Full details: Errors & conventions.

If a Key is Compromised​

  1. Revoke the key in the Dashboard immediately
  2. Create a new key
  3. Update your application with the new key
  4. Audit recent orders for unauthorized activity