Authentication

API Keys

All API requests require authentication using a Bearer token in the Authorization header.

Authorization: Bearer YOUR_API_KEY

Getting Your API Key

Go to innova-trading.com and sign in to your account.

Navigate to Settings

Click on your profile and go to Settings → API Keys.

Create a New Key

Click “Create API Key”, give it a name, and copy the generated key.

The API key is only shown once. Store it securely!

Using Your API Key

curl https://api.innova-trading.com/api/external/bars \
  -H "Authorization: Bearer sk_live_abc123..."

import requests

API_KEY = "sk_live_abc123..."

response = requests.get(
    "https://api.innova-trading.com/api/external/bars",
    params={"symbol": "EURUSD", "timeframe": 60},
    headers={"Authorization": f"Bearer {API_KEY}"}
)

const API_KEY = "sk_live_abc123...";

const response = await fetch(
  "https://api.innova-trading.com/api/external/bars?symbol=EURUSD&timeframe=60",
  {
    headers: { Authorization: `Bearer ${API_KEY}` }
  }
);

Signal providers

This page describes API keys for candles and external indicators. If you run a system that already generates signals and want Innova to copy them, the rules are different: see the Signal Providers guide.

For signal providers, the key is not a free-form string:

It is a personal token handed to you by Innova. Ask your contact at Innova for it.
Every call must also send the x-community-slug header (the slug of your community). It is mandatory.
The host is https://cloud.innova-trading.com.

Authorization: Bearer <YOUR_TOKEN>
x-community-slug: <YOUR_COMMUNITY>

Full details, endpoints and error codes are in the Signal Providers guide.

Security Best Practices

Never expose in client code

API keys should only be used server-side. Never include them in frontend JavaScript.

Use environment variables

Store your API key in environment variables, not in source code.

Rotate regularly

Generate new API keys periodically and revoke old ones.

Use separate keys

Create different keys for development and production.

Environment Variables

INNOVA_API_KEY=sk_live_abc123...

import os

API_KEY = os.environ.get("INNOVA_API_KEY")

const API_KEY = process.env.INNOVA_API_KEY;

Error Responses

401 Unauthorized

Missing or invalid API key:

{
  "error": "unauthorized",
  "message": "Missing Authorization header"
}

{
  "error": "unauthorized",
  "message": "Invalid API key"
}

403 Forbidden

Valid API key but no access to the requested resource:

{
  "error": "forbidden",
  "message": "Symbol XAUUSD not allowed for your API key",
  "allowed_symbols": ["EURUSD", "GBPUSD", "USDJPY"]
}

API Key Permissions

Each API key has specific permissions:

Permission	Description
`read:bars`	Fetch OHLC market data
`write:indicators`	Submit indicator signals
`read:indicators`	Read submitted indicators
`delete:indicators`	Delete indicators

By default, new API keys have all permissions enabled. Contact support for custom permission setups.

Rate Limiting

API keys are rate-limited based on your plan:

Plan	Requests/Hour	Concurrent
Free	100	5
Pro	1,000	20
Enterprise	Custom	Custom

When rate limited, you’ll receive:

{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Please wait before retrying.",
  "retry_after": 60
}

Use exponential backoff when hitting rate limits. Start with a 1-second delay and double it with each retry.

Get Started

Core Concepts

Guides

API Keys

Getting Your API Key

Using Your API Key

Signal providers

Security Best Practices

Never expose in client code

Use environment variables

Rotate regularly

Use separate keys

Environment Variables

Error Responses

401 Unauthorized

403 Forbidden

API Key Permissions

Rate Limiting

​API Keys

​Getting Your API Key

​Using Your API Key

​Signal providers

​Security Best Practices

Never expose in client code

Use environment variables

Rotate regularly

Use separate keys

​Environment Variables

​Error Responses

​401 Unauthorized

​403 Forbidden

​API Key Permissions

​Rate Limiting

API Keys

Getting Your API Key

Using Your API Key

Signal providers

Security Best Practices

Environment Variables

Error Responses

401 Unauthorized

403 Forbidden

API Key Permissions

Rate Limiting