Authentication

Every SDK call is authenticated by your broker account's subscription key — one secret bearer token for your whole organisation. The broker is always resolved from the key, never from the request body, so your key can only ever reach your own clients.

curl -H "Authorization: Bearer tlyt_sk_your_key_here" \
     -H "Content-Type: application/json" \
     https://api.tradlyt.com/api/v1/sdk/v1/users/CLIENT00423

• Prefixed tlyt_sk_ followed by a URL-safe secret.
• One key per broker account. It authenticates every user and every call.
• Stored as a SHA-256 hash on our servers — the raw key is shown once, at creation (and once again on rotation). It cannot be retrieved afterwards.

Your clients never hold a TradLyt credential, never see a TradLyt login, and never appear to us by name — you address each of them by your own user_ref.

Rotation

If your key leaks, TradLyt rotates it for you. Rotation issues a new key and immediately invalidates the old one — all in-flight integrations must switch to the new key. There is no overlap window, so schedule rotation during a maintenance slot.

Rate limits

Each broker account has its own request ceiling, contracted with your seat count and applied across your whole book. Exceeding it returns 429; the account's limit is set per partner, so tell us your expected peak during onboarding rather than discovering it in production.

Auth failures

Status	Cause
401	No credential, or a bearer token that doesn't start with tlyt_sk_, or a key that doesn't resolve.
403	Your account is not active, or the call targets a feature you don't have enabled.
429	Your account's request ceiling was exceeded.

Store the key in a secrets manager

Treat it like a production database password. Never commit it to source control, and never expose it to client-side code — every call is server-to-server from your backend.