6MM API Authentication: JWT and API Keys

6MM supports JWT access tokens and API Keys for private API access. Choose the method based on whether the request belongs to an interactive user session or a long-running backend integration.

Choose an authentication method

JWT

After login, the API returns an accessToken. When calling private endpoints, include:

1
Authorization: Bearer YOUR_ACCESS_TOKEN

Keep the token out of URLs and logs. When a token expires, obtain a valid token through the approved login or refresh flow before retrying the private request.

API Key

When the X-API-KEY request header is present, the server uses API Key HMAC authentication:

1
X-API-KEY: YOUR_API_KEY

API Key management endpoints must use JWT. API Keys cannot manage themselves.

API Key requests also require the timestamp and HMAC signature described in Request Signing. Store the corresponding API secret only in a backend secret-management system.

API Key Permissions

To grant both read and trade permissions, use permissions=3.

Use the smallest permission set required by the integration. A market-data service should not receive trade permissions, while an order service needs the trade permission even when it only queries orders or positions.

Production security checklist

• Create separate API Keys for development, staging, and production.
• Apply an IP whitelist where the integration has stable outbound addresses.
• Never expose API secrets in browser, mobile, or desktop application code.
• Synchronize server time before generating signed requests.
• Redact authorization headers, API Keys, signatures, and secrets from application logs.
• Revoke and replace a key immediately when exposure is suspected.

Next steps