Account Setup

Step 1 — Enable two-factor authentication

API key creation is refused with 403 until 2FA is enabled on your account.

Log in to your Wellat Dashboard.
Open your Profile page → Security tab.
Enable Two-Factor Authentication and complete the enrollment with your authenticator app.

Step 2 — Understand the credential pair

Credential	Format	Where it lives
API key	`wlt_bot_` + 64 hex chars	Public identifier. Sent with every bot request (`x-bot-api-key` header).
Secret key	64 hex chars	Shown exactly once, at creation. Used to sign requests; never sent directly.

❗️
The secret is shown once and cannot be recovered
Wellat does not store your secret key. If you lose it, revoke the key and create a new one. Copy it into your bot server's secret storage the moment it is displayed.

A key belongs to your user account, not to a single strategy: one key can sign trades for every bot-managed strategy you own.

Prerequisites: a KYC-complete trader account, 2FA enabled, and fewer than 10 existing keys (the per-account maximum).

Step 3 — Create a key

On The Wellat Dashboard, click "Connect Bot"

Wellat Dashboard
Enter your a label. This is for recognising an API key for your bot

Bot API key label
By "Creating API Key" for your bot will provide you an API and Secret key.

👍
Rotate with overlap, zero downtime
Create the new key → deploy it to your bot → confirm signals flow → revoke the old key. Both keys are valid during the overlap. One key per bot deployment keeps lastUsedAt and revocation mapped cleanly to a single machine.

Handling credentials safely

Store the secret in an environment variable or secrets manager — never in source control, logs, or client-side code.
Treat the API key as public-ish (it identifies, it doesn't authorize), but there's no reason to publish it.

Errors

HTTP	When
`401`	Missing/expired session token
`403`	Account is not a KYC-complete trader, or 2FA is not enabled
`409`	Key limit reached (10 per account)
`400`	Invalid body (missing `label`, label over 64 chars)
`404`	Revoking a key `id` that doesn't exist or belongs to another account

Next: Authentication — how your bot signs every request with these credentials.