Skip to main content
The ApiTokenService handles the partner self-service token lifecycle: capability checks, token derivation, listing active tokens, and revocation.
Token derivation and capability queries require a Privy identity token. The SDK does not obtain this token for you — your application must authenticate the partner via Privy and pass the resulting token.

Access

The service is available on the root Client:

Get partner capabilities

Check whether token management is enabled and which scopes are allowed:

Derive a token

Create a new scoped API token. The secret is returned once — store it securely.

Create an HMAC-authenticated client

After deriving a token, create a new client with those HMAC credentials:
The Rust DeriveApiTokenInput always sends scopes; pass at least one scope explicitly, e.g. scopes: vec![SCOPE_TRADING.to_string()]. An empty vector is rejected with HTTP 400 (“At least one scope is required”). The backend’s ["trading"] default only applies when the key is absent from the request body.

List active tokens

Returns all non-revoked tokens for the authenticated partner:

Revoke a token

Immediately invalidate a token:

Scope constants

The Rust SDK exports typed string constants: