Skip to main content
Every request is signed with your Ed25519 key. Give the client your key id and private key seed, and it signs each request and sets the PX-* headers for you. Create a client once and reuse it for every call.
The private key seed is 32 bytes as 64 lowercase hex characters. It never leaves your process: only the key id, a timestamp, and the signature go on the wire. Load it from an environment variable or secret manager rather than committing it.

​
Where Python reads your credentials

ParlayX() reads PARLAYX_KEY_ID and PARLAYX_PRIVATE_KEY_HEX from the environment when you do not pass them:
To take a credential from somewhere else, pass it directly. Each one resolves on its own, so the key id can be inline while the private key stays out of your source:
Only an omitted argument falls back to the environment. An argument you pass is used as given, and a blank one is refused rather than replaced, so a lookup of your own that returned an empty string cannot end up signing as a different account. A credential that is neither passed nor exported raises ValueError naming the variable it wanted, at construction rather than on your first request. AsyncParlayX and StreamClient take the same arguments and read the same two variables.

​
Registering the key

You generate the keypair in your own environment and register the public half with ParlayX. See Authentication for the wire-level canonical string, key registration, and revocation.

​
Clock skew

The signature covers a timestamp the API checks against its own clock, within 30 seconds. A host whose clock has drifted further will see every request fail with UNAUTHORIZED, which looks like a bad key rather than a bad clock. Keep NTP running. The server clock is verified without a timestamp, so it still works on a drifted host and lets you measure the offset.
The client targets the production API. Reuse a single instance across your application.