The GlacierPay API lets your systems request quotes, execute trades, and track settlements programmatically. Access is controlled by API keys that an administrator creates and manages from the dashboard.
Creating a key
An administrator generates a key in the API section of settings. Each key is issued once, so the secret is shown a single time at creation and must be stored securely by your team at that moment.
- Scope each key to only the permissions it needs
- Use separate keys for trading and for read-only reporting
- Restrict access to known server addresses where possible
- Rotate keys periodically and revoke any that are unused
Keeping keys safe
Treat an API secret like a password. Store it in a secrets manager rather than in source code, and never share it in plain text over email or chat. If a key is ever exposed, revoke it immediately and issue a replacement.
Because keys are scoped, a reporting integration never needs a key that can trade. Granting only what each system requires limits the impact if a credential is compromised.