The Tradallo public agent API atDocumentation Index
Fetch the complete documentation index at: https://docs.tradallo.com/llms.txt
Use this file to discover all available pages before exploring further.
https://www.tradallo.com/api/v1/ accepts
two auth modes:
| Mode | How | Budget |
|---|---|---|
| Anonymous | No Authorization header | 60 req/min per IP |
| API key | Authorization: Bearer tdo_live_… | Per-tier per-key (see below) |
Tiers and budgets
| Tier | Budget | Webhooks | Notes |
|---|---|---|---|
| Free | 60 req/min/key | — | Same numerical budget as anonymous, but per-key (stable) |
| Active | 600 req/min/key | basic | 10× free; the bucket for an in-prod agent doing routine track-record / UTR polling |
| Elite | 6,000 req/min/key | full + priority indexing | 100× free; the bucket for a copy-trade fleet operator |
Issuing a key
- Sign in at tradallo.com.
- Open Settings → API keys.
- Click New key, give it a name (e.g. production agent), and copy the full key from the reveal banner immediately. Tradallo stores only a SHA-256 hash — we cannot show the plaintext again.
Using a key
Pass the key as a Bearer token:@tradallo/agent-gate and @tradallo/reputation both pick up
TRADALLO_API_KEY from the environment automatically:
Key format
Keys look like:tdo_live_is the only prefix issued today.tdo_test_is reserved in the schema for a future test mode.- Both prefixes are registered with GitHub’s secret-scanning partner program — accidentally committing a key to a public repo will trigger an automatic alert and revocation.
Rate-limit responses
A throttled call returns429 Too Many Requests with these headers:
| Header | Meaning |
|---|---|
Retry-After | Seconds to wait before retrying |
X-RateLimit-Limit | Per-minute budget for your tier |
X-RateLimit-Remaining | Calls remaining in the current window |
X-RateLimit-Reset | Unix milliseconds when the window resets |
@tradallo/agent-gate,
@tradallo/reputation) parse these and back off correctly without your
code having to handle 429 explicitly.
Rotation and revocation
- Rotate: create a new key, switch your agent to it, then revoke the old one. There’s no rotate-in-place — the new-key + revoke-old pattern keeps the audit trail intact.
- Revoke: in Settings → API keys, click Revoke. Calls using the key
get
401 Unauthorizedimmediately. Revoked keys stay in the table so audit lookups (“which key produced this request?”) still resolve. - Lost a key: revoke and create a new one. Tradallo cannot show the plaintext after the initial reveal — only the SHA-256 hash is stored.
Why no scopes (yet)
The v1 public API is read-only — every endpoint returns signed envelopes of publicly verifiable data. There are no mutating endpoints behind API keys, so scopes would be granting “read-public” on top of “read-public.” When mutating endpoints land (webhook subscriptions, x402 payment intents, custom indexing pins), keys will gain ascopes array and the issuance UI
will surface checkbox selection.
Next
Quickstart
Add a Tradallo gate to your agent in five minutes.
Reference library
Full type signatures and edge cases for
@tradallo/agent-gate.
