> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.6mm.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.6mm.com/_mcp/server.

# 6MM API Authentication: JWT and API Keys

> Learn how to authenticate private 6MM API requests with JWT access tokens or API keys and choose the appropriate method for each integration.

6MM supports JWT access tokens and API Keys for private API access. Choose the method based on whether the request belongs to an interactive user session or a long-running backend integration.

## Choose an authentication method

| Integration need                          | Recommended method       | Why                                                                 |
| ----------------------------------------- | ------------------------ | ------------------------------------------------------------------- |
| User-session API calls                    | JWT                      | Uses the access token returned after login.                         |
| Create, update, or revoke API Keys        | JWT                      | API Key management endpoints do not accept API Key self-management. |
| Server-to-server account or trading calls | API Key + HMAC signature | Supports scoped permissions and signed backend requests.            |

## JWT

After login, the API returns an `accessToken`. When calling private endpoints, include:

```http
Authorization: Bearer YOUR_ACCESS_TOKEN
```

Keep the token out of URLs and logs. When a token expires, obtain a valid token through the approved login or refresh flow before retrying the private request.

## API Key

When the `X-API-KEY` request header is present, the server uses API Key HMAC authentication:

```http
X-API-KEY: YOUR_API_KEY
```

API Key management endpoints must use JWT. API Keys cannot manage themselves.

API Key requests also require the timestamp and HMAC signature described in [Request Signing](/developer-api/request-signing). Store the corresponding API secret only in a backend secret-management system.

## API Key Permissions

| Value | Permission | Description                                                                                                                                                                                    |
| ----- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `1`   | Read       | User info, assets, account change logs, statistics, listenKey, favorite symbols, and related user/account endpoints. Order and position endpoints, including queries, require Trade permission |
| `2`   | Trade      | Order and position endpoints, including both query and write operations                                                                                                                        |
| `4`   | Withdraw   | Reserved fund permission                                                                                                                                                                       |

To grant both read and trade permissions, use `permissions=3`.

Use the smallest permission set required by the integration. A market-data service should not receive trade permissions, while an order service needs the trade permission even when it only queries orders or positions.

## Production security checklist

* Create separate API Keys for development, staging, and production.
* Apply an IP whitelist where the integration has stable outbound addresses.
* Never expose API secrets in browser, mobile, or desktop application code.
* Synchronize server time before generating signed requests.
* Redact authorization headers, API Keys, signatures, and secrets from application logs.
* Revoke and replace a key immediately when exposure is suspected.

## Next steps

#### [API Key Management](/developer-api/api-key-management)

Create scoped keys, configure IP restrictions, and plan key rotation.

#### [Request Signing](/developer-api/request-signing)

Build the HMAC-SHA256 payload and sign private requests.

#### [Errors & Troubleshooting](/developer-api/error-codes-and-troubleshooting)

Diagnose rejected credentials, timestamps, signatures, and permissions.