Authentication

Every request is authenticated with an API key sent as a Bearer token.

Authorization: Bearer murmo_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys are created in the Murmo app and are prefixed murmo_. The key identifies your user and can place trades and move funds into positions on your behalf. Guard it accordingly.

The key is sent in the Authorization header only. It is never read from the query string, because query strings get captured in load-balancer and CDN logs. Don’t put your key in a URL.

What a key can and cannot do

Allowed

Reads (identity, account, positions, trades), group spot trades, prediction and perp positions, group membership and settings, and chat.

Not allowed

Withdrawing funds out of your wallet and managing API keys. These require an interactive (in-app) session and have no API route. Your key cannot drain your wallet to an external address.

Funds you deposit can be deployed (swapped, staked into positions) by the key, but they cannot be withdrawn by it. To move money out, use the app.

API keys are scoped to the REST API (/api/v1) and the real-time WebSocket gateways. They are not accepted on the GraphQL endpoint (/graphql) — that’s the interactive app surface and requires a session. A key used against GraphQL returns 403 FORBIDDEN.

Inspect the current credential

GET /api/v1/me echoes who you are, which key you’re using (metadata only — never the secret), and your rate budget:

curl https://api.alpha-labs.trade/api/v1/me \
  -H "Authorization: Bearer $MURMO_API_KEY"

{
  "data": {
    "userId": "d66bafb2-...",
    "authMethod": "apiKey",
    "apiKey": {
      "id": "ak_...",
      "label": "my-bot",
      "prefix": "murmo_froc",
      "lastUsedAt": "2026-06-02T19:00:00.000Z",
      "expiresAt": null,
      "createdAt": "2026-05-20T12:00:00.000Z"
    },
    "rateLimit": { "limit": 1200, "windowSeconds": 60 }
  }
}

Rate limits

API-key traffic is limited to 1,200 requests per 60-second window. Over the limit you’ll receive 429 Too Many Requests — back off and retry. The budget is reported on GET /api/v1/me.

Polling? Prefer WebSockets for live prices and chat instead of tight REST loops — it’s lower latency and won’t burn your rate budget.

WebSocket authentication

The same murmo_ key authenticates the real-time gateways. Pass it in the Socket.IO handshake auth.token (or an Authorization: Bearer header) — never in the query string:

import { io } from "socket.io-client";

const socket = io("wss://api.alpha-labs.trade/perps", {
  transports: ["websocket"],
  auth: { token: process.env.MURMO_API_KEY }, // "murmo_..."
});

See Real-time overview.

Errors

Status	Meaning
`401 Unauthorized`	Missing/invalid `Authorization` header or key.
`403 Forbidden`	Authenticated, but not permitted (e.g. not a member of the group, or an in-app-only action).
`429 Too Many Requests`	Rate limit exceeded.

See Errors for the response shapes and codes.

Security checklist

Store the key in a secret

Environment variable or secret manager — never in source control or a URL.

Send it only over HTTPS / WSS

Always TLS. Never log the full key; the prefix is enough to identify it.

Rotate if exposed

Revoke and recreate the key in the app if it leaks. Keys can be scoped/expired there.

Get started

Example flows

Core concepts

Trading guides

Real-time (WebSockets)

What a key can and cannot do

Allowed

Not allowed

Inspect the current credential

Rate limits

WebSocket authentication

Errors

Security checklist

​What a key can and cannot do

Allowed

Not allowed

​Inspect the current credential

​Rate limits

​WebSocket authentication

​Errors

​Security checklist

What a key can and cannot do

Inspect the current credential

Rate limits

WebSocket authentication

Errors

Security checklist