Account Endpoints

Manage your profile, API keys, and exchange credentials. All account endpoints require JWT authentication (issued via the auth endpoints).

Profile

Get Profile

GET /account/profile

curl -s https://papi.tylerthebuildor.com/account/profile \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

{
  "id": "usr_abc123",
  "email": "user@example.com",
  "name": "Jane Doe",
  "avatar_url": "https://...",
  "email_verified": true,
  "providers": ["email", "google"],
  "created_at": "2026-01-15T08:00:00Z"
}

Field	Type	Description
`id`	string	User ID
`email`	string	Email address
`name`	string	Display name
`avatar_url`	string \| null	Profile image URL
`email_verified`	boolean	Whether email has been verified
`providers`	array	Auth providers linked (e.g., `email`, `google`, `github`)
`created_at`	string	ISO 8601 account creation time

Update Profile

PATCH /account/profile

curl -X PATCH https://papi.tylerthebuildor.com/account/profile \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{
    "display_name": "Jane D.",
    "avatar_url": "https://example.com/avatar.jpg"
  }'

Field	Type	Description
`display_name`	string	New display name
`avatar_url`	string	New avatar URL

Both fields are optional. Only provided fields are updated.

API Keys

Each user is limited to one API key. Delete your existing key before creating a new one.

List API Keys

GET /account/api-keys

curl -s https://papi.tylerthebuildor.com/account/api-keys \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

{
  "keys": [
    {
      "prefix": "papi_sk_live_a1b2",
      "name": "Production",
      "scopes": ["read", "trade"],
      "created_at": "2026-01-15T08:00:00Z",
      "last_used_at": "2026-03-18T10:30:00Z"
    }
  ]
}

The full key is never returned -- only a prefix for identification.

Create API Key

POST /account/api-keys

curl -X POST https://papi.tylerthebuildor.com/account/api-keys \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production",
    "scopes": ["read", "trade"]
  }'

Request body:

Field	Type	Required	Description
`name`	string	No	Label for the key
`scopes`	array	No	Array of scopes: `read`, `trade`, `admin`

Response:

{
  "key": "papi_sk_live_a1b2c3d4e5f6g7h8...",
  "prefix": "papi_sk_live_a1b2",
  "name": "Production",
  "scopes": ["read", "trade"]
}

The key field contains the full API key. This is the only time it is returned. Save it immediately and store it securely.

Revoke API Key

DELETE /account/api-keys/{key_prefix}

curl -X DELETE https://papi.tylerthebuildor.com/account/api-keys/papi_sk_live_a1b2 \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

Revoked keys immediately stop working. This cannot be undone.

Exchange Credentials

Check Credential Status

GET /account/credentials

Check which exchanges have credentials configured without revealing any credential values.

curl -s https://papi.tylerthebuildor.com/account/credentials \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

{
  "exchanges": {
    "polymarket": {
      "configured": true,
      "wallet_address": "0x742d35Cc..."
    },
    "kalshi": {
      "configured": false
    }
  }
}

Store Polymarket Credentials

PUT /account/credentials/polymarket

curl -X PUT https://papi.tylerthebuildor.com/account/credentials/polymarket \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "your-clob-api-key",
    "secret": "your-clob-secret",
    "passphrase": "your-passphrase",
    "wallet_address": "0x742d35Cc..."
  }'

Field	Type	Required	Description
`api_key`	string	Yes	Polymarket CLOB API key
`secret`	string	Yes	CLOB API secret
`passphrase`	string	Yes	CLOB API passphrase
`wallet_address`	string	Yes	Your Polymarket wallet address

Store Kalshi Credentials

PUT /account/credentials/kalshi

curl -X PUT https://papi.tylerthebuildor.com/account/credentials/kalshi \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{
    "access_key": "your-kalshi-access-key",
    "private_key": "your-kalshi-private-key"
  }'

Field	Type	Required	Description
`access_key`	string	Yes	Kalshi API access key
`private_key`	string	Yes	Kalshi API private key

Remove Credentials

DELETE /account/credentials/{exchange}

Exchange values: polymarket, kalshi

curl -X DELETE https://papi.tylerthebuildor.com/account/credentials/polymarket \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

After removal, trading requests to that exchange will fail until new credentials are stored.

Credential Security

Credentials are encrypted with AES-256-GCM at the application layer before storage
Stored in PostgreSQL in encrypted form
Decrypted only at request time, in memory
Never logged or exposed in API responses
Previous credentials for the same exchange are overwritten on update

Account

On this page