Authentication

Programmatic access uses Ed25519 API keys. The SDK signs authenticated ConnectRPC requests and fetches private realtime tokens for you.

Recommended: explicit credentials

accountID := "..." // Profile → Account ID
client, err := polyester.New(polyester.Config{
    Environment:      &polyester.TestnetEnvironment,
    APIKeyID:         "ak_...",
    APIPrivateKey:    auth.NewSecret("..."), // 64-char hex from key creation
    DefaultAccountID: &accountID,
    HydrateCatalogs:  true,
})
if err != nil { log.Fatal(err) }
defer client.Close()
ctx := context.Background()
if err := client.WaitForCatalogs(ctx); err != nil { log.Fatal(err) }

APIPrivateKey is an auth.Secret (package github.com/Fabric-Labs/polyester-sdk-go/auth). Printing or logging the Config, or encoding it as JSON or XML, shows [REDACTED] instead of the key. Read it back explicitly with cfg.APIPrivateKey.Reveal() when you store it on purpose.

Environment variables

Read secrets in your process and pass them in:

accountID := os.Getenv("POLYESTER_ACCOUNT_ID")
client, err := polyester.New(polyester.Config{
    Environment:      &polyester.TestnetEnvironment,
    APIKeyID:         os.Getenv("POLYESTER_API_KEY_ID"),
    APIPrivateKey:    auth.NewSecret(os.Getenv("POLYESTER_API_PRIVATE_KEY")),
    DefaultAccountID: &accountID,
    HydrateCatalogs:  true,
})

For scripts only, polyester.FromEnv() loads credentials, Account ID, the environment preset, and optional API/WebSocket URL overrides. It targets Testnet only when POLYESTER_ENV=testnet is set. Prefer explicit Config in production.

Generate a keypair

pair := client.APIKeys.GenerateKeypair()

Local key material only. Subscribing to key updates uses client.APIKeys with an API key; listing keys needs a session. Creating API keys is JWT/session-only (TypeScript / browser), not exposed on this SDK.

See API keys.

Public vs private

• Public market data works with no key.
• Private RPCs and private WebSocket channels need a key and Account ID.
• Streams: use Messages(), Go has no Recv().

Subaccount scope

Set DefaultSubAccountID for default scoping, or pass per-call account scope where the service supports it.

Concept: Authentication model. Config: Client configuration.

Related Topics