ApiTokenService handles the partner self-service token lifecycle: capability checks, token derivation, listing active tokens, and revocation.
Token derivation and capability queries require a Privy identity token. The SDK does not obtain this token for you — your application must authenticate the partner via Privy and pass the resulting token.
Access
The service is available on the rootClient:
Get partner capabilities
Check whether token management is enabled and which scopes are allowed:Derive a token
Create a new scoped API token. Thesecret is returned once — store it securely.
Create an HMAC-authenticated client
After deriving a token, create a new client with those HMAC credentials:DeriveApiTokenInput always sends scopes; pass at least one scope explicitly, e.g. scopes: vec![SCOPE_TRADING.to_string()]. An empty vector is rejected with HTTP 400 (“At least one scope is required”). The backend’s ["trading"] default only applies when the key is absent from the request body.