Getting Your API Key

To access Rulebook Company’s market microstructure data, you’ll need an API key.

Request Access

1

Contact Sales

Email aaron@rulebookcompany.com with:
  • Your firm name and role
  • Use case description
  • Expected data volume
  • Integration timeline
2

Review Terms

Our team will provide: - Pricing information - Data licensing agreement - Service level agreement (SLA) - Trial options for qualified firms
3

Receive Credentials

After agreement, you’ll receive:
  • API key via secure email
  • Access to documentation
  • Integration support contact
Enterprise trials are available for qualified institutional trading firms.

Managing Your API Key

Secure Storage

Never hardcode API keys in your source code. Use secure storage solutions:
# Using environment variables
import os
API_KEY = os.environ.get('RULEBOOK_API_KEY')

# Using AWS Secrets Manager
import boto3
from botocore.exceptions import ClientError

def get_secret():
    secret_name = "rulebook/api_key"
    region_name = "us-east-1"

    session = boto3.session.Session()
    client = session.client(
        service_name='secretsmanager',
        region_name=region_name
    )

    try:
        get_secret_value_response = client.get_secret_value(
            SecretId=secret_name
        )
    except ClientError as e:
        raise e

    return get_secret_value_response['SecretString']
// Using environment variables
const API_KEY = process.env.RULEBOOK_API_KEY;

// Using AWS Secrets Manager
const AWS = require("aws-sdk");
const client = new AWS.SecretsManager({
  region: "us-east-1",
});

async function getSecret() {
  try {
    const data = await client
      .getSecretValue({
        SecretId: "rulebook/api_key",
      })
      .promise();

    return data.SecretString;
  } catch (err) {
    throw err;
  }
}
# Using environment variables
export RULEBOOK_API_KEY="your_api_key_here"

# In production, use your organization's secret management
# Examples: HashiCorp Vault, AWS Secrets Manager, etc.

Security Best Practices

  • Rotate API keys every 90 days minimum
  • Contact support to generate new keys
  • Implement zero-downtime key rotation in your systems
  • Development environment: separate API key - Staging environment: separate API key - Production environment: separate API key - Never share keys between environments
  • Limit API key access to authorized personnel only - Use IP whitelisting when available - Monitor API usage for anomalies
  • Set up alerts for unusual API call patterns
  • Track rate limit usage
  • Monitor error rates

Key Rotation

When rotating API keys:
  1. Generate new key: Contact support for a new API key
  2. Update staging: Deploy new key to staging environment
  3. Test thoroughly: Verify all integrations work with new key
  4. Update production: Deploy new key to production
  5. Revoke old key: Inform support to revoke the old key after 24 hours
If your API key is ever compromised, contact support immediately to revoke it and issue a new one.

Troubleshooting

Common API key issues:
  • Check that your API key is correctly formatted
  • Verify the Authorization header is set properly
  • Ensure the key hasn’t expired or been revoked
  • Check your current rate limits in the dashboard - Implement exponential backoff in your code - Contact support to discuss higher limits
  • Verify your subscription includes access to the requested endpoint
  • Check if IP whitelisting is configured correctly
  • Ensure your key has the necessary permissions

Need Help?

Contact Support

Our team can help with API key management, rotation, and security best practices.