1. What Is an API Key

OSL Institution supports system integration via API Keys, letting you access account data, place trades, and perform other operations programmatically without having to log in and act manually every time. Each API Key can have its own access scope (Portfolio Level / Institution Level) and permissions (Read-Only, Trade, Transfer, Withdraw), and can be bound to an IP whitelist to reduce the risk of misuse if it's ever exposed.

If your institution has an approval rule configured for "Create API Key," a new key will first go through the approval flow, and once approved you'll still need to complete one more activation step before it can actually be used — see Section 2 below for the full flow.

2. How to Use It

2.1 Creating an API Key

Go to the API page and click Create API in the top right, then complete the following 3 steps.

Step 1: Create

• Label (required): a name for this key, 8–32 letters or numbers

• Password (required): set a password, 8–32 letters or numbers. Remember this — if this key ends up requiring approval, you'll need this same password to complete activation once it's approved

• Access Level (required):

  • Portfolio Level: access to this portfolio only

  • Institution Level: access to all portfolios under this institution, including future ones

• Permission settings (required):

  • Read-Only: allows calling query-type APIs only (checked by default, cannot be unchecked)

  • Trade: can perform Convert and StableHub trading

  • Transfer: can perform transfers within a portfolio

  • Withdraw: can initiate withdrawals; Institution-level keys can also create Portfolios

• Only allow access to specific addresses (required): bind an IP whitelist — each key can be bound to up to 30 IP addresses, separated by commas

Click Next once you're done.

Step 2: Verify

Enter your email verification code and Google Authenticator code, then click Submit.

Step 3: Done

• If "Create API Key" does not require approval: you'll immediately see "API created successfully," along with the Access API Key and Secret Key. The Secret Key is shown only this once, so save it securely right away — it can't be viewed again later.

• If this request matches an approval rule: the key won't be shown yet. The request goes into the approval flow first, and the key will appear under API → Pending API with a status of Pending Activation, waiting for approval before it can be activated (see the next step).

2.2 Activating an API Key

One easy-to-miss point: even after approval, the key does not activate automatically — you still need to complete a manual activation step before it can be used.

Once approved, go to API → Pending API, find the corresponding key, and click Activate:

• Enter the API passphrase (the same Password you set in Step 1 when creating the key)

• Enter your email verification code and Google Authenticator code

• Click Next to complete activation

Once activated, the Access API Key and Secret Key are shown (again, only this once), and the key moves from Pending API to the Active API tab with a status of Activated, ready for use.

2.3 Managing Existing Keys

• Active API tab: shows keys that are activated and in use, with columns for Label, API Key (masked), Access Level, Permissions, Status, and Active By (who activated it and when). Supports View / Edit / Delete.

• Pending API tab: shows keys still awaiting activation, with columns for Label, Access Level, Permissions, Status, and Submit By (who submitted it and when). Supports Activate / View.

3. A Few Things Worth Keeping in Mind

• The Secret Key is only shown once, at the moment a key is created or activated, and can never be viewed again afterward — save it securely right away to avoid losing access or exposing it and putting your assets at risk

• For better security, it's recommended to bind an IP whitelist to every API Key; each key supports up to 30 IPs