API Keys

For programmatic or bot access, create a personal API key tied to your account and send it as x-api-key. Public market reads work without one; user routes that are not public reject a missing key with 401 Invalid API Key provided.

Base URL
`https://api.unitedmarket.ai`

United Market is now live on BNB Smart Chain mainnet. We just launched — start trading on-chain prediction markets today.

How authentication works

x-api-key — required on routes that are not public (API key management, referral summary, most profile writes). The web app always sends a shared key; for your own integrations, create a personal key (below). Public market reads and SIWE nonce/verify do not require it.
Missing or unknown keys return 401 { "message": "Invalid API Key provided", "error": "Unauthorized", "statusCode": 401 } — even if you also sent a SIWE bearer. That message is from the API-key guard, not JWT validation.
Authorization: Bearer <token> — additionally required for user-specific endpoints (your orders, your keys, etc.). Obtain it via Sign In & Trade.

Create a key

curl -X POST "https://api.unitedmarket.ai/me/api-keys" \
  -H "x-api-key: WEB_KEY" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "name": "trading-bot" }'

The key is shown once — store it immediately:

{
  "id": "…",
  "name": "trading-bot",
  "prefix": "umk_live_AbC123",
  "tier": "DEFAULT",
  "key": "umk_live_xxxxxxxxxxxxxxxxxxxx"
}

You can also create and rotate keys from the app at /api-keys.

Use a key

curl "https://api.unitedmarket.ai/markets" \
  -H "x-api-key: umk_live_xxxxxxxxxxxxxxxxxxxx"

Rotate or revoke

# rotate — the old secret stops working; a new one is returned once
curl -X POST "https://api.unitedmarket.ai/me/api-keys/{id}/rotate" \
  -H "x-api-key: WEB_KEY" -H "Authorization: Bearer ACCESS_TOKEN"

# revoke
curl -X DELETE "https://api.unitedmarket.ai/me/api-keys/{id}" \
  -H "x-api-key: WEB_KEY" -H "Authorization: Bearer ACCESS_TOKEN"

Secrets are stored hashed and can never be shown again after creation. If you lose a key, rotate it.

Rate limits

Requests are rate-limited per key (or as anon for the shared web key / no key). Responses include X-RateLimit-Limit-short (per second), X-RateLimit-Limit-medium (per minute), plus Remaining and Reset variants; exceeding a limit returns 429 Too Many Requests. Respect both windows — they are independent, not perMin / 60. Fallback ceilings when a route has no @RouteLimit class:

Tier	Per second	Per minute
DEFAULT	10	300
PRO	50	3000
MM	100	6000
INTERNAL	1000	60000

The shared web key is anon, not DEFAULT. On market-read that is 100/s and 3000/min. A new DEFAULT personal key is tighter than anon on several read classes — if a bot 429s after switching keys, ask for PRO or MM rather than creating another DEFAULT key. Order-write and cancel have their own class budgets (MM write is 60/s and 3000/min; cancel is roughly 2× write). Batch posts are weighted by order count. Contact the team to raise your tier.

Overview

Guides

API Reference

How authentication works

Create a key

Use a key

Rotate or revoke

Rate limits

​How authentication works

​Create a key

​Use a key

​Rotate or revoke

​Rate limits

How authentication works

Create a key

Use a key

Rotate or revoke

Rate limits