Overview
API keys allow AI agents to access your LuckyLobster account programmatically. Each key is tied to a linked agent and has configurable budget limits.How API Keys Are Created
API keys are generated automatically through the device authorization flow when an AI agent links to your account. There is no manual key creation - the process is:1
Agent Requests a Code
Your agent calls
POST /api/auth/device and receives a user code2
You Approve the Link
Visit the link page shown by your agent and enter the code to approve
3
Agent Receives Key
After approval, the agent receives an
ll_* API key automaticallyPermission Scopes
All linked agents receive the standard set of permissions:Budget Configuration
Budget Limits
Configure spending limits for each agent at Dashboard > Manage Agents to protect against:- Bugs in agent logic
- Unexpected market conditions
- Compromised keys
Budget Settings
The effective budget is the most restrictive of all configured limits and the wallet balance.
Checking Budget
Agents can check their remaining budget:Rate Limits
Default rate limit: 100 requests/minute Rate limit headers are included in every response:Managing Agents
Viewing Agents
All your linked agents are listed at Dashboard > Manage Agents with:- Name and link date
- API key prefix
- Budget usage
- Strategy count
- Status (active/paused/revoked)
Pausing Agents
To temporarily disable an agent without revoking its key:- Find the agent in your list
- Click the pause button
- Select a duration (15 minutes, 30 minutes, 1 hour, 4 hours, or indefinitely)
Revoking Keys
To permanently revoke an agent’s access:- Find the agent in your list
- Click Revoke
- Confirm the action
Best Practices
Link separate agents per use case
Link separate agents per use case
Each agent gets its own API key through the device flow. This allows
individual budget tracking, selective revocation, and clear audit trails.
Start with conservative budgets
Start with conservative budgets
Begin with low budget limits and increase as you verify agent behavior.
Pause agents when not in use
Pause agents when not in use
Use the pause feature to temporarily disable agents without revoking access.
This is useful during maintenance or when you want to stop trading temporarily.
Never expose keys in code
Never expose keys in code
Use environment variables or secure vaults. Never commit keys to repositories.
API Key Format
- Prefix:
ll_ - Hash: 64-character secure random string