VERSION HISTORY
Authentication
Fetches the article and compares it with Version 2.
▸Version 2October 13, 2026, 4:45 PM+3−3
Changes shown against Version 1.
when they attempt a trading request.
Copy trading follows the same account boundary. A lead order requires access to
its lead and every configured follower in the same environment. A key limited
to the lead account cannot place the lead trade while that copy group is
enabled. The request returns 404 with account_not_found before any order is
created; followers are never silently omitted. Use a key covering the complete
group or manage the trade on the website.
Modifications, cancellations, and protective-exit changes also require access
to every copied account they would affect. This includes outstanding copied
orders from a group that has since been disabled. A live key never grants
access to a sandbox follower, even when the website configuration includes it.
Keys created before scoped access was introduced retain read and trading access
− to every owned account until they are revoked. The API information and
− tradable-market catalog endpoints are public; account state, quotes, positions,
− and orders require a key.
+ to every owned account until they are revoked. The API information,
+ tradable-market catalog, and restricted-countries endpoints are public; account
+ state, quotes, positions, and orders require a key.
Environments
Every key belongs to one environment, named by its prefix and served on its
own hostname:
Environment | Key prefix | Base URL | Reaches
Live | fp_live_ | https://developers.myfundedperpetuals.com | Your challenge accounts
Test | fp_test_ | https://sandbox.myfundedperpetuals.com | Your sandbox accounts only
A key presented on the other environment's host returns 401 with a message
naming the correct host. Test keys and sandbox accounts are covered in
Sandbox and test keys.
CLI sessions
The fperp command-line tool can sign in without a manually created API key.
Running fperp login opens your browser to an approval page; approving mints
SHA-256 91202a532554a928590df480d051946290d617ddd01022eaabcfc66e286c09da
▸Version 1October 11, 2026, 2:36 PM
First archived version.
Authentication
Source: https://docs.myfundedperpetuals.com/authentication
Authenticate requests with a MyFundedPerps API key.
Send your API key in the HTTP Authorization header with the Bearer scheme:
http theme={null}
Authorization: Bearer fp_live_...
Each API key has an access level and account boundary:
Access level | Allowed requests
Read Only | Accounts, markets, quotes, positions, orders, and fills
Read And Trade | Read requests plus order and position changes
Account access can cover every account you own or one selected challenge
account. Requests for an account outside the key's boundary return 404, the
same response used for an account you do not own. Read-only keys receive 403
when they attempt a trading request.
Copy trading follows the same account boundary. A lead order requires access to
its lead and every configured follower in the same environment. A key limited
to the lead account cannot place the lead trade while that copy group is
enabled. The request returns 404 with account_not_found before any order is
created; followers are never silently omitted. Use a key covering the complete
group or manage the trade on the website.
Modifications, cancellations, and protective-exit changes also require access
to every copied account they would affect. This includes outstanding copied
orders from a group that has since been disabled. A live key never grants
access to a sandbox follower, even when the website configuration includes it.
Keys created before scoped access was introduced retain read and trading access
to every owned account until they are revoked. The API information and
tradable-market catalog endpoints are public; account state, quotes, positions,
and orders require a key.
Environments
Every key belongs to one environment, named by its prefix and served on its
own hostname:
Environment | Key prefix | Base URL | Reaches
Live | fp_live_ | https://developers.myfundedperpetuals.com | Your challenge accounts
Test | fp_test_ | https://sandbox.myfundedperpetuals.com | Your sandbox accounts only
A key presented on the other environment's host returns 401 with a message
naming the correct host. Test keys and sandbox accounts are covered in
Sandbox and test keys.
CLI sessions
The fperp command-line tool can sign in without a manually created API key.
Running fperp login opens your browser to an approval page; approving mints
an expiring CLI session credential that authenticates exactly like a live API
key with trading access to every account you own. The credential is stored in
your operating system keychain by default.
CLI sessions differ from API keys in three ways:
- They expire automatically 90 days after sign-in. An expired session returns
401 and fperp login mints a new one.
- fperp logout revokes the session server-side immediately.
- They exist only in the live environment. Use a test API key with
fperp login --api-key for the sandbox host.
You can hold up to five CLI sessions at once (one per machine, for example);
signing in past that limit revokes the oldest session. On a remote or headless
machine, fperp login --manual shows a one-time code in the browser to paste
into the terminal instead of using a local callback.
Keep keys server-side
API keys are long-lived credentials. Store them in a secret manager or an
encrypted environment registry. Do not commit a key, print it in logs, include
it in a URL, or ship it in frontend code.
Treat test keys with the same care: a leaked test key still exposes your
sandbox trading activity and consumes your request budgets.
Rotate a key
Create a replacement key, update your client, confirm it can make an
authenticated read, and then revoke the old key in
API Key Settings.
Revocation takes effect for new requests immediately; a request already in
flight may still finish.
SHA-256 2ecbb0254dc79b558ee89b2f4e869fa06bc97bd2499c11aae9209a1677bdf7ca