> ## Documentation Index
> Fetch the complete documentation index at: https://docs.limitless.exchange/llms.txt
> Use this file to discover all available pages before exploring further.

# API Tokens

> Manage scoped API tokens with the Rust SDK

The `ApiTokenService` handles the partner self-service token lifecycle: capability checks, token derivation, listing active tokens, and revocation.

<Note>
  Token derivation and capability queries require a **Privy identity token**. The SDK does not obtain this token for you — your application must authenticate the partner via Privy and pass the resulting token.
</Note>

## Access

The service is available on the root `Client`:

```rust theme={null}
use limitless_exchange_rust_sdk::Client;

let client = Client::new()?;

// Use client.api_tokens.*
```

## Get partner capabilities

Check whether token management is enabled and which scopes are allowed:

```rust theme={null}
let capabilities = client
    .api_tokens
    .get_capabilities(identity_token)
    .await?;

println!("{}", capabilities.token_management_enabled);
println!("{:?}", capabilities.allowed_scopes);
```

## Derive a token

Create a new scoped API token. The `secret` is returned once — store it securely.

```rust theme={null}
use limitless_exchange_rust_sdk::{
    DeriveApiTokenInput, SCOPE_ACCOUNT_CREATION, SCOPE_DELEGATED_SIGNING, SCOPE_TRADING,
};

let derived = client
    .api_tokens
    .derive_token(
        identity_token,
        &DeriveApiTokenInput {
            label: Some("production-bot".to_string()),
            scopes: vec![
                SCOPE_TRADING.to_string(),
                SCOPE_ACCOUNT_CREATION.to_string(),
                SCOPE_DELEGATED_SIGNING.to_string(),
            ],
        },
    )
    .await?;

println!("{}", derived.token_id);
println!("{:?}", derived.scopes);
```

### Create an HMAC-authenticated client

After deriving a token, create a new client with those HMAC credentials:

```rust theme={null}
use limitless_exchange_rust_sdk::{Client, HmacCredentials};

let http = Client::builder()
    .hmac_credentials(HmacCredentials {
        token_id: derived.token_id.clone(),
        secret: derived.secret.clone(),
    })
    .build()?;

let scoped_client = Client::from_http_client(http)?;
```

If `scopes` is omitted when deriving the token, the backend defaults it to `["trading"]`.

## List active tokens

Returns all non-revoked tokens for the authenticated partner:

```rust theme={null}
let tokens = scoped_client.api_tokens.list_tokens().await?;

for token in tokens {
    println!(
        "{} {:?} {:?} {:?}",
        token.token_id,
        token.label,
        token.scopes,
        token.last_used_at
    );
}
```

## Revoke a token

Immediately invalidate a token:

```rust theme={null}
let message = scoped_client.api_tokens.revoke_token(&derived.token_id).await?;
println!("{}", message);
```

## Scope constants

The Rust SDK exports typed string constants:

| Constant                  | Value                 |
| ------------------------- | --------------------- |
| `SCOPE_TRADING`           | `"trading"`           |
| `SCOPE_ACCOUNT_CREATION`  | `"account_creation"`  |
| `SCOPE_DELEGATED_SIGNING` | `"delegated_signing"` |
| `SCOPE_WITHDRAWAL`        | `"withdrawal"`        |