API Key & Host Setup

Create an API key in Key Management, store the secret safely, and copy the current host from the DNS widget before making signed requests.

Where this lives in the client UI

Create credentials in Key Management and copy the current host shown by the DNS widget before sending signed requests.

• •

  API Key

  Create an API key and store its identifier and private signing key securely.

• •

  DNS host widget

  Show the current API host. For Trader API, this is the Gateway host: use it to discover the Access Point for the account before sending account-scoped REST requests or connecting to WebSockets.

• •

  Trading account

  Select the trading account or account group that the key can access.

Key Management flow

1. 1
   Log in to Personal Area or the client portal.
2. 2
   Open Key Management.
3. 3
   Create a new API key.
4. 4
   Select the key type when supported by the product UI.
5. 5
   Fill in the key name, expiry date, trading account, and allowed IPs if these fields are enabled.
6. 6
   Store the API key identifier and private signing key securely. Follow the selected key creation flow below.
7. 7
   Copy the host from the DNS widget. For Trader API, use this Gateway host to resolve the account Access Point before making REST requests or WebSocket connections.

Values to store

Value	Where it comes from	Client use
EXN_API_KEY	Key Management	Identifies the API key in signed requests.
EXN_PRIVATE_KEY	Private signing key from the selected key creation flow	Used locally to create request signatures.
EXN_ACCOUNT_ID	Selected trading account	Used in account-scoped endpoints.
EXN_API_BASE_URL	Product-specific API host	For Trader API, use the account Access Point returned by discovery.
EXN_DISCOVERY_BASE_URL	DNS widget in Key Management	Trader API Gateway base URL used to discover the account Access Point.

API key creation options

API keys support two key-pair creation flows:

• •

  Exness generates the key pair

  Follow the key creation flow in Key Management and store the private signing key securely when it is provided.

• •

  You generate the key pair

  Generate an Ed25519 key pair and register its public key using I'll use my own public key. Keep the private key on your machine or trusted backend.

Both options are available for all API keys, regardless of the selected product or scopes.

Private key formats and library inputs

When Exness generates the key pair, the private_key value is 128 hex characters representing a 64-byte Ed25519 private key: the 32-byte seed followed by the 32-byte public key. Save this value securely when it is provided. It is hex text, not PEM, Base64 or the API key identifier.

When you generate the key pair with the OpenSSL commands below, private.pem is an unencrypted PKCS#8 PEM file. These are different containers for Ed25519 signing material; load the format your library expects.

The complete read-only example shows how to import either format, discover the Access Point and send a signed read-only request in TypeScript, Python or Go.

Generate your own Ed25519 key pair

Use OpenSSL 1.1.1 or newer with Ed25519 support. Run the commands below in Bash or zsh on macOS or Linux, or use one of the Windows options below.

macOS and Linux

First select the OpenSSL executable. On Linux, check the executable available on your path:

OPENSSL_BIN=openssl
command -v "$OPENSSL_BIN"
"$OPENSSL_BIN" version

On macOS, /usr/bin/openssl may be LibreSSL and may not support Ed25519. Select a compatible OpenSSL installation explicitly. For example, if OpenSSL 3 is already installed with Homebrew:

OPENSSL_BIN="$(brew --prefix openssl@3)/bin/openssl"
"$OPENSSL_BIN" version

For an installation from another source, set OPENSSL_BIN to its full executable path and run the same version check. Continue only when the command reports OpenSSL 1.1.1 or newer with Ed25519 support. If no compatible installation is available, install one through your approved software installation process first.

Keep using the selected OPENSSL_BIN in the same terminal for the commands below.

Windows

The commands in this guide require a Bash-compatible shell. Use one of the following:

• •

  WSL (recommended)

  Open a WSL distribution such as Ubuntu and follow the Linux steps above. Keep private.pem inside the Linux file system (for example, ~/), not under /mnt/c/ or another Windows drive mount. With the default WSL mount settings, chmod does not enforce Linux file permissions on Windows drives.

• •

  Git Bash

  Git for Windows includes OpenSSL. Open Git Bash, set OPENSSL_BIN=openssl, and run the version check from the steps above. Continue only if it reports OpenSSL 1.1.1 or newer with Ed25519 support. Do not rely on chmod 600 in Git Bash to restrict Windows file access. Before generating the key, use Windows folder permissions to restrict access to your Windows account.

Do not run these commands in PowerShell or Command Prompt: they rely on Bash-compatible shell features. PowerShell versions earlier than 7.4 can also corrupt binary DER data passed through a pipeline.

Create the private key

Run the commands in a private directory. The check below stops if private.pem already exists, including a symbolic link.

(
  umask 077
  if [ -e private.pem ] || [ -L private.pem ]; then
    printf '%s\n' 'private.pem already exists. Use a new directory.' >&2
    exit 1
  fi
  "$OPENSSL_BIN" genpkey -algorithm ED25519 -out private.pem || exit 1
  chmod 600 private.pem
)

private.pem contains your unencrypted private key in PKCS#8 PEM format. Keep it secret and retain a secure backup. Do not upload it to Key Management. Load it locally using the key format required by your signing library.

Encode the public key for Key Management

Export the complete Ed25519 SubjectPublicKeyInfo (SPKI, also called PKIX) DER public key and encode it as standard padded Base64:

(
  set -o pipefail
  "$OPENSSL_BIN" pkey -in private.pem -pubout -outform DER | "$OPENSSL_BIN" base64 -A
)

openssl base64 -A produces a single-line value. Keep its Base64 padding. Do not add spaces or line breaks.

Use the complete DER public key. Do not use tail -c 32 to extract the raw key bytes: Base64 of the raw 32-byte key is not the registration format.

Register the public key

1. 1
   When creating an API key in Key Management, select I'll use my own public key.
2. 2
   Paste the single-line Base64 output from the command above into the public key field. Paste it unchanged, without spaces or line breaks.
3. 3
   Configure the required access using the available settings and complete API key creation.
4. 4
   Store the API key identifier and keep private.pem securely. Use the private key to sign requests locally.

The API key identifier sent in EXN-API-KEY is different from the public key you register. Request headers EXN-DATA and EXN-SIGN use base64url without padding; the public key registration value uses standard padded Base64.

Troubleshoot public key input

Problem	What to check
Public key rejected	Export the public key again from the private key you intend to use. Submit the complete SPKI DER public key encoded as standard padded Base64.
PEM text pasted	Do not paste a BEGIN PUBLIC KEY block. Use the DER and Base64 export command above. Never paste the private key.
Spaces or line breaks	Run the command with openssl base64 -A and paste only its single-line output. Spaces and line breaks are not accepted.
Raw-key Base64 supplied	Do not extract the last 32 bytes. Export and encode the complete DER/SPKI public key.

Existing API keys and the Exness-generated key flow remain supported. You do not need to replace a working key because of this guide. Both creation flows use the same documented Ed25519 request-signing protocol.

Current review hosts

For Trader API, the DNS widget host is the Gateway for discovery. Always resolve the account Access Point before account-scoped REST requests or WebSocket connections. Use the returned Access Point for those requests.

These static values are review/prototype examples, not fallback hosts for Trader API requests:

Host	Status	Client action
https://api.exness.com	Main	Review/prototype example only. For Trader API, use the Gateway host from the DNS widget and resolve the account Access Point before REST requests or WebSocket connections. This static value is not an alternative to discovery.
https://api.exness-api.com	Alternative	Review/prototype example only. For Trader API, use the Gateway host from the DNS widget and resolve the account Access Point before REST requests or WebSocket connections. This static value is not an alternative to discovery.

Example

The example below is for Trader API. The environment variable names are illustrative, and the values are placeholders. For Trader API, set EXN_DISCOVERY_BASE_URL to the DNS widget Gateway URL, then set EXN_API_BASE_URL to the returned access_point. Set EXN_PRIVATE_KEY to the private key text provided by Key Management. For your own key pair, use the PEM contents of private.pem.

export EXN_API_KEY="exnsk-{your_public_api_key}"
export EXN_PRIVATE_KEY="your_private_key_text"
export EXN_ACCOUNT_ID="123456"
export EXN_DISCOVERY_BASE_URL="https://gateway.example"
export EXN_API_BASE_URL="https://access-point.example"

Do not create API keys through the Exness API.

Use Key Management for API key creation, host visibility, revocation, and rotation.

Security rules

• Store the secret key securely.
• Do not commit it to Git, paste it into chats, hardcode it in production, or include it in screenshots.
• If the secret key is lost, create a new API key.
• If the secret key is leaked, revoke the API key and create a new one.
• Use allowed IPs when the product UI supports IP restrictions.