Every backend request must include an API key in the x-api-key header. For
programmatic or bot access, create a personal API key tied to your account.
| Network | Base URL |
|---|
| Testnet | https://backend-develop.themarketunited.com |
United Market is currently in sandbox/development stage. All funds, balances, markets, and trades are for testing only and do not represent real money.
How authentication works
x-api-key — required on every request. The web app ships a shared key; for your own integrations, create a personal key (below).Authorization: Bearer <token> — additionally required for user-specific endpoints (your orders, your keys, etc.). Obtain it via Sign In & Trade.
Create a key
Sign in with SIWE first, then:
curl -X POST "https://backend-develop.themarketunited.com/me/api-keys" \
-H "x-api-key: WEB_KEY" \
-H "Authorization: Bearer ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{ "name": "trading-bot" }'
key is shown once — store it immediately:
{
"id": "…",
"name": "trading-bot",
"prefix": "umk_live_AbC123",
"tier": "DEFAULT",
"key": "umk_live_xxxxxxxxxxxxxxxxxxxx"
}
/api-keys.
Use a key
curl "https://backend-develop.themarketunited.com/markets" \
-H "x-api-key: umk_live_xxxxxxxxxxxxxxxxxxxx"
Rotate or revoke
# rotate — the old secret stops working; a new one is returned once
curl -X POST "https://backend-develop.themarketunited.com/me/api-keys/{id}/rotate" \
-H "x-api-key: WEB_KEY" -H "Authorization: Bearer ACCESS_TOKEN"
# revoke
curl -X DELETE "https://backend-develop.themarketunited.com/me/api-keys/{id}" \
-H "x-api-key: WEB_KEY" -H "Authorization: Bearer ACCESS_TOKEN"
Secrets are stored hashed and can never be shown again after creation. If you lose a key, rotate it.
Rate limits
Requests are rate-limited per key. Responses include X-RateLimit-Limit-*,
X-RateLimit-Remaining-*, and X-RateLimit-Reset-* headers; exceeding a limit
returns 429 Too Many Requests.
| Tier | Per second | Per minute |
|---|
| DEFAULT | 10 | 300 |
| PRO | 50 | 3000 |
| INTERNAL | 1000 | 60000 |
