Security Best Practices

API key security is your responsibility. A compromised key can execute trades against your deposited balance and read your account data. It cannot move funds off the platform — withdrawals, deposits, and on-chain transfers all require the user's embedded-wallet signature plus a passkey step-up, which are only available in the mobile app. This guide covers battle-tested practices used by institutional trading desks.

The recommended approach is to store credentials in a separate config.json file that is never committed to version control.

Step 1: Create config.json

{
    "api_key": "a1b2c3d4e5f6789012345678abcdef00",
    "api_secret": "s3cr3t_k3y_n3v3r_sh4r3_th1s_w1th_4ny0n3",
    "user_address": "0xA6E3c04eF78427b5B53F43CDBA881d7E15B0bccD",
    "base_url": "https://openapi.gaiaex.com/v1/trade"
}

Step 2: Add to .gitignore

# .gitignore
config.json
*.secret
.env
.env.*

Step 3: Load in Your Code

Python:

import json

with open("config.json") as f:
    config = json.load(f)

API_KEY = config["api_key"]
API_SECRET = config["api_secret"]
ADDRESS = config["user_address"]

JavaScript / Node.js:

const fs = require('fs');
const config = JSON.parse(fs.readFileSync('config.json', 'utf8'));

const API_KEY = config.api_key;
const API_SECRET = config.api_secret;
const ADDRESS = config.user_address;

Rust:

use serde::Deserialize;
use std::fs;

#[derive(Deserialize)]
struct Config {
    api_key: String,
    api_secret: String,
    user_address: String,
}

let cfg: Config = serde_json::from_str(
    &fs::read_to_string("config.json")?
)?;

{
    "api_key": "PASTE_YOUR_API_KEY_HERE",
    "api_secret": "PASTE_YOUR_API_SECRET_HERE",
    "user_address": "0xYOUR_WALLET_ADDRESS",
    "base_url": "https://openapi.gaiaex.com/v1/trade"
}

For CI/CD pipelines, Docker containers, and cloud deployments, environment variables are the standard approach.

# Set in your shell profile, .env file, or CI secrets
export GAIAEX_API_KEY="a1b2c3d4e5f6789012345678abcdef00"
export GAIAEX_API_SECRET="s3cr3t_k3y_n3v3r_sh4r3_th1s"
export GAIAEX_ADDRESS="0xA6E3c04eF78427b5B53F43CDBA881d7E15B0bccD"

Python:

import os

API_KEY = os.environ["GAIAEX_API_KEY"]
API_SECRET = os.environ["GAIAEX_API_SECRET"]

Lock your API key to specific IP addresses. Even if the key leaks, it cannot be used from unauthorized locations.

{
    "ip_whitelist": ["203.0.113.50", "198.51.100.0/24"]
}

Configure IP whitelisting when creating an API key via the GaiaEx mobile app or the POST /api-keys endpoint.

GaiaEx API keys support granular permissions. Only grant the minimum permissions needed.

Recommendation:

• Monitoring scripts → ["read"] only
• Trading bots → ["read", "trade"]
• Never create "all permissions" keys unless absolutely necessary

Rotate API keys regularly — especially after team member departures, suspected leaks, or security incidents.

Rotation Procedure

1. Create a new key via the GaiaEx app or POST /api-keys
2. Update your config.json or environment variables with the new key
3. Verify the new key works (call GET /time or GET /health)
4. Revoke the old key via DELETE /api-keys/{key_id}

Recommended rotation schedule:

Monitor your API key activity for unauthorized access.

• Check the audit log via GET /api-keys/{key_id}/audit — shows all API calls made with that key
• Monitor order history — unexpected orders may indicate compromised keys
• Set up alerts — use User Data Stream WebSocket to get real-time notifications of trades and balance changes

What to Watch For