Create API Key

To access the Bron API, you need an API key. Follow the steps below to create one:

Enable API Key Access

Go to Settings › Security › Security policies and make sure Enable API key creation under Other settings is turned on. If it is disabled, contact your workspace owner to enable it.

Start a New API Key creation

In Settings › API keys, click New API key. Enter a name, select a team role, an expiration period, account access, and (optionally) specify allowed IP addresses.

Generate or Supply Your Key Pair

Bron uses asymmetric keys. You have two options:

Generation type	Description
Self-generation	Generate the key pair yourself and share only the public key with Bron. Keep the private key secure.
Browser generation	The browser generates the key pair; the private key never leaves the browser and is shown only once.

When you supply your own JWK, it must meet these requirements:

Property	Requirement
kty	Must be `"EC"`.
crv	One of `"P-256"`, `"P-384"`, `"P-521"`, `"SECP256K1"` or `"Ed25519"`.
x, y	Both required; base64url-encoded curve coordinates.
No private fields	Must not include `"d"` or any other private-key material.
kid (optional)	20–30 alphanumeric characters or hyphens (`^[0-9A-Za-z\-]{20,30}$`). Auto-generated if omitted.

Example JWK

{"kty": "EC", "crv": "P-256", "x": "f83OJ3…x5YhE", "y": "x_FEzRu9…GtENQ", "kid": "a1B2c3D4e5F6g7H8i9J0"}

How to generate a key?

You can use any library that supports ES256 and JWK. For example:

JavaScript (Node.js): panva/jose
Java: Nimbus JOSE + JWT
Or any other ES256-compatible library.

Node.js example:

import { generateKeyPair, exportJWK } from 'jose';

const { publicKey, privateKey } = await generateKeyPair('ES256');
const publicJwk  = await exportJWK(publicKey);
const privateJwk = await exportJWK(privateKey);

console.log(JSON.stringify(publicJwk));  // Send this to Bron
console.log(JSON.stringify(privateJwk)); // Keep this safe

API key roles

The team role picked at creation decides what the key can do. Every role is scoped to the accounts selected for the key.

Role	Reads	Creates transactions	Signs
View only	✓
Transaction Operator	✓	✓
Full Access	✓	✓	✓
MPC Hot Signer	✓		✓

Reads cover workspaces, accounts, balances, addresses, transactions, quotes (swap-route, intents/quote) and the address book. Signing covers signing requests and hot signer registration; a Transaction Operator key creates transactions that a person or an MPC Hot Signer key then signs. Transaction types a Transaction Operator or Full Access key can create with POST /workspaces/{workspaceId}/transactions (and POST /workspaces/{workspaceId}/intents for intents):

`transactionType`	What it does
`withdrawal`	Send an asset to an external address or an address-book record
`allowance`	Approve a spender for an ERC20 token
`address-activation`	Activate an address on the network
`address-creation`	Register an address on the network
`swap-lifi`	Swap via Li.Fi with a `quoteId` from `swap-route`
`intents`	Swap via the Intents protocol
`intent-solver-settlement`	Settle an Intents order as a solver
`bridge`	Move an asset between connected networks
`nft-withdrawal`	Send an NFT
`shield`	Move a token into its confidential (private) balance
`unshield`	Move a token out of its confidential balance
`confidential-withdrawal`	Send from a confidential balance
`zama-decrypt`	Decrypt a confidential balance
`offer-accept`	Accept an incoming deposit offer
`stake-pool-creation`	Create a staking pool
`stake-delegation`	Delegate to a validator
`stake-undelegation`	Request undelegation
`stake-claim`	Claim unbonded funds
`stake-take-reward`	Move staking rewards to the balance
`raw-transaction`	Submit a prepared contract call
`raw-message`	Sign an arbitrary message

defi and defi-message (WalletConnect), earn-*, fiat-*, loyalty-* and bron-lock-* transactions are created from the Bron app only.

API Documentation

assets

intents

workspaces

accounts

address-book

addresses

balances

canton

stake

transaction-limits

transactions

API key roles

​API key roles

API key roles