Authentication

Create a Developer API Key and send it as a Bearer token on every request.

Every request needs a Developer API Key, sent as a Bearer token.

curl https://showmytrades.com/api/v1/accounts \
  -H "Authorization: Bearer smt_live_YOUR_KEY"

Creating a key

Open your dashboard

Go to Settings → Developer API Keys.

Create the key

Give it a name that says where it will run — Claude Desktop, Monday report script. When a key needs revoking, the name is all you have to go on.

Copy it immediately

The key is shown once. We store only a hash of it, so we cannot show it to you again or recover it for you — not even by asking support.

Do not confuse it with your Connection Key. The Connection Key is what your Expert Advisor uses to send data to ShowMyTrades. The Developer API Key is what you use to read data back out. They live on different pages and are not interchangeable.

Losing a key

There is no recovery. Revoke the lost key and create a new one — revoking takes effect immediately, and anything still using that key stops working at once.

You can hold up to 10 active keys. Revoked keys do not count towards the limit, so rotating a key never locks you out.

Scopes

Each key carries the permissions it was created with.

accounts:read
scope
Read the accounts and portfolios you own, including the ones you have not published.
public:read
scope
Read and search accounts that other people have published. Never touches private accounts, and never returns personal details about their owners.

Keys are created with both. A request that needs a scope the key does not have gets a 403, not a 401 — the key is valid, the permission is not.

The API is part of Pro

Creating a key and calling the API both require an active Pro plan. A valid key on a plan that has lapsed gets a 402 — the key is not revoked and does not need to be recreated: it starts working again on its own as soon as the plan is active.

This is a different thing from the Connection Key used by the Expert Advisor to send us your trades. That one is free, has nothing to do with this page, and is not affected by your plan.

Keeping a key safe

Treat it like a password
Anyone holding your key can read everything you can, including your private accounts.
Keep it server-side
Never put a key in a web page, a mobile app or a public repository. Browsers cannot call this API cross-origin anyway, which is deliberate.
One key per integration
Separate keys mean you can revoke the one that leaked without breaking everything else.