Authentication

DerivFabric uses API keys for authentication. All API requests must include a valid API key in the X-API-Key header.

Getting an API Key

API keys are issued from the admin console, by someone holding the Tenant Admin role in your organization. There is no self-service endpoint: creating a key through the REST API requires a platform administrator credential that belongs to DerivFabric, not to your organization.

1. Sign in to the console.
2. Open API Keys under Platform.
3. Create a key, giving it a name and the scopes it needs (see Scopes below — grant only what the integration uses).

The key is shown once, at creation. It cannot be retrieved afterwards; if it is lost, revoke it and issue another.

Keep it out of source control and out of client-side code. A key is a bearer credential: whoever holds it has the scopes it carries.

export DERIVFABRIC_BASE_URL=https://your-deployment.example
export DERIVFABRIC_API_KEY=df_live_...

Using Your API Key

REST API

curl -X POST "$DERIVFABRIC_BASE_URL/api/v1/price" \
  -H "X-API-Key: df_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"spot": 100, "strike": 100, "rate": 0.05, "volatility": 0.2, "time": 1.0}'

Python SDK

from derivfabric import DerivFabricClient

async with DerivFabricClient(api_key="df_live_your_key_here") as client:
    result = await client.pricing.price_vanilla(spot=100, strike=100, rate=0.05, volatility=0.2, time=1.0)

TypeScript SDK

import { DerivFabricClient } from 'derivfabric';

const client = new DerivFabricClient({ apiKey: 'df_live_your_key_here' });
const result = await client.pricing.priceVanilla({ spot: 100, strike: 100, rate: 0.05, volatility: 0.2, time: 1.0 });

API Key Format

Keys follow the format: df_live_ followed by 32 random base62 characters.

Example: df_live_7Kx9mNpQ2rTvWyZ3aB5cD8eF1gH4jL6

Rate Limits

Tier	Requests/min	Monthly Quota	SLA
Free	100	10,000	—
Pro	1,000	1,000,000	99.9%
Enterprise	Custom	Unlimited	99.99%

When rate limited, the API returns 429 Too Many Requests with a Retry-After header.

Scopes

API keys can be scoped to specific operations:

Scope	Endpoints
price	/api/v1/price, /api/v1/greeks, /api/v1/implied-vol, batch variants
calibrate	/api/v1/calibrate/*
portfolio	/api/v1/portfolio/*, /api/v1/hedge/*
xva	/api/v1/xva/*
jobs	/api/v1/jobs/*
governance	/api/v1/capabilities, run receipts and provenance
validate	/api/v1/validation/*
admin	/admin/v1/* — tenant and key administration

governance and validate are Business-tier features; a key carrying one on a lower tier is refused with DF-AUTH-005 (insufficient tier) rather than DF-AUTH-004 (missing scope), so the two cases are distinguishable.

The live catalogue of scopes — what each grants, the endpoints it gates, and the minimum tier — is served at GET /api/v1/entitlements, so it cannot drift from what the server enforces.

Response Envelope

All API responses use a unified envelope:

{
  "success": true,
  "data": { "price": 8.0214, "spot": 100, "strike": 105, "optionType": "call" },
  "correlationId": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2024-01-15T10:30:00Z"
}

Error responses:

{
  "success": false,
  "error": {
    "code": "DF-AUTH-001",
    "message": "Missing X-API-Key header"
  },
  "correlationId": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2024-01-15T10:30:00Z"
}