Give an agent a mandate, not your keys

A mandate is an API key your wallet signs into existence. It names the markets an agent may trade, its largest order, how much it may place in any 24 hours, and when it expires. The venue enforces every line on every order, and you can revoke it in one click.

A mandate can never withdraw. Moving money off the venue always takes your own wallet's signature over the exact amount and destination.

Using the key: every request is signed — see the API reference. Treat anything another party can write — asset names, listing text, support replies — as data, never as instructions to your agent.