Sub-Keys API: Create Child API Keys (Quant)

The Sub-Keys API lets Quant accounts create up to 25 child API keys under a single active root key. Child keys inherit the Quant tier and can access all data endpoints, but they cannot create, update, revoke, or rotate keys. You can optionally apply per-child quota and RPM overrides to limit usage — overrides can only reduce limits below the parent tier ceiling, never increase them.

Sub-keys are available on Quant accounts only. All management routes require authentication with a session JWT or the root API key. Child keys cannot call management routes.

GET /account/sub-keys

Returns all active child keys with their current-month request counts. Tiers: Quant

curl -sS \
  -H "Authorization: Bearer $CS2C_API_KEY" \
  "https://api.cs2c.app/account/sub-keys?limit=10&offset=0"

import os

import cs2cap

configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

with cs2cap.ApiClient(configuration) as client:
    api = cs2cap.AccountAPIKeysApi(client)
    response = api.list_sub_keys(
        limit=10,
        offset=0,
    )

print(client.sanitize_for_serialization(response))

import { Configuration, AccountAPIKeysApi } from "cs2cap";

const accessToken = process.env.CS2C_API_KEY;

if (!accessToken) {
  throw new Error("Set CS2C_API_KEY before running this example.");
}

const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
const response = await api.listSubKeys({ limit: 10, offset: 0 });

console.log(response);

limit

integer

default:"25"

Page size, clamped to 1–100.

offset

integer

default:"0"

Zero-based starting position.

Response example

{
  "keys": [
    {
      "key": {
        "id": "cccccccc-cccc-cccc-cccc-cccccccccccc",
        "key_prefix": "sk_live_child",
        "name": "research-bot",
        "root_key_id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
        "is_root_key": false,
        "is_active": true,
        "created_at": "2026-03-02T12:00:00Z",
        "last_used_at": "2026-03-03T08:10:00Z",
        "expires_at": null,
        "quota_requests_per_month_override": 50000,
        "rate_requests_per_minute_override": 120,
        "effective_quota_requests_per_month": 50000,
        "effective_rate_requests_per_minute": 120
      },
      "requests_this_month": 812
    }
  ],
  "pagination": {
    "limit": 25,
    "offset": 0,
    "total": 1
  }
}

keys[].key

object

Key metadata object. Fields are identical to those returned by GET /account/key.

keys[].requests_this_month

integer

Number of requests made with this child key in the current calendar month.

pagination.total

integer

Total number of active child keys.

POST /account/sub-keys

Creates a new child API key and returns the plaintext key value once. Tiers: Quant

curl -sS -X POST \
  -H "Authorization: Bearer $CS2C_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"analytics-worker","quota_requests_per_month_override":100000}' \
  "https://api.cs2c.app/account/sub-keys"

import os

import cs2cap

configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

with cs2cap.ApiClient(configuration) as client:
    api = cs2cap.AccountAPIKeysApi(client)
    response = api.create_sub_key(
        cs2cap.ChildAPIKeyCreateRequest(
            name="analytics-worker",
            quota_requests_per_month_override=100000,
        )
    )

print(client.sanitize_for_serialization(response))

import { Configuration, AccountAPIKeysApi } from "cs2cap";

const accessToken = process.env.CS2C_API_KEY;

if (!accessToken) {
  throw new Error("Set CS2C_API_KEY before running this example.");
}

const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
const response = await api.createSubKey({
  childAPIKeyCreateRequest: {
    name: "analytics-worker",
    quotaRequestsPerMonthOverride: 100000,
  },
});

console.log(response);

name

string

required

Display name for the child key (e.g., research-bot).

quota_requests_per_month_override

integer

Optional monthly request cap for this child key. Must be less than or equal to the parent tier quota. Omit to inherit the parent tier ceiling with no additional child-specific cap.

rate_requests_per_minute_override

integer

Optional per-minute rate limit for this child key. Must be less than or equal to the parent tier RPM. Omit to inherit the parent ceiling.

Request body

{
  "name": "research-bot",
  "quota_requests_per_month_override": 50000,
  "rate_requests_per_minute_override": 120
}

The plaintext key is returned once only in the creation response. Copy and store it securely immediately. You cannot retrieve the plaintext value again after this response. Attempting to create more than 25 child keys returns 409.

GET /account/sub-keys/:id

Returns one active child key and its current-month request count. Tiers: Quant

curl -sS \
  -H "Authorization: Bearer $CS2C_API_KEY" \
  "https://api.cs2c.app/account/sub-keys/YOUR_KEY_ID"

import os

import cs2cap

configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

key_id = "YOUR_CHILD_KEY_ID"

with cs2cap.ApiClient(configuration) as client:
    api = cs2cap.AccountAPIKeysApi(client)
    response = api.get_sub_key(
        key_id
    )

print(client.sanitize_for_serialization(response))

import { Configuration, AccountAPIKeysApi } from "cs2cap";

const accessToken = process.env.CS2C_API_KEY;

if (!accessToken) {
  throw new Error("Set CS2C_API_KEY before running this example.");
}

const keyId = "YOUR_CHILD_KEY_ID";

const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
const response = await api.getSubKey({ keyId });

console.log(response);

key_id

string

required

UUID of the child key to retrieve.

PATCH /account/sub-keys/:id

Updates a child key’s name and optional quota or RPM overrides. Tiers: Quant

curl -sS -X PATCH \
  -H "Authorization: Bearer $CS2C_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"analytics-worker-v2","quota_requests_per_month_override":200000}' \
  "https://api.cs2c.app/account/sub-keys/YOUR_KEY_ID"

import os

import cs2cap

configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

key_id = "YOUR_CHILD_KEY_ID"

with cs2cap.ApiClient(configuration) as client:
    api = cs2cap.AccountAPIKeysApi(client)
    response = api.update_sub_key(
        key_id,
        cs2cap.ChildAPIKeyUpdateRequest(
            name="analytics-worker-v2",
            rate_requests_per_minute_override=60,
        ),
    )

print(client.sanitize_for_serialization(response))

import { Configuration, AccountAPIKeysApi } from "cs2cap";

const accessToken = process.env.CS2C_API_KEY;

if (!accessToken) {
  throw new Error("Set CS2C_API_KEY before running this example.");
}

const keyId = "YOUR_CHILD_KEY_ID";

const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
const response = await api.updateSubKey({
  keyId,
  childAPIKeyUpdateRequest: {
    name: "analytics-worker-v2",
    rateRequestsPerMinuteOverride: 60,
  },
});

console.log(response);

key_id

string

required

UUID of the child key to update.

name

string

Updated display name.

quota_requests_per_month_override

integer | null

Updated monthly quota cap, or null to remove the child-specific cap and fall back to the parent tier ceiling.

rate_requests_per_minute_override

integer | null

Updated RPM limit, or null to remove the child-specific cap and fall back to the parent tier ceiling.

Request body

{
  "name": "research-bot-v2",
  "quota_requests_per_month_override": 25000,
  "rate_requests_per_minute_override": 60
}

Set an override field to null to remove that child-specific cap. The child key will then use the full parent tier ceiling for that limit.

DELETE /account/sub-keys/:id

Revokes an active child key. The key immediately stops authenticating requests. Tiers: Quant

curl -sS -X DELETE \
  -H "Authorization: Bearer $CS2C_API_KEY" \
  "https://api.cs2c.app/account/sub-keys/YOUR_KEY_ID"

import os

import cs2cap

configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

key_id = "YOUR_CHILD_KEY_ID"

with cs2cap.ApiClient(configuration) as client:
    api = cs2cap.AccountAPIKeysApi(client)
    response = api.delete_sub_key(
        key_id
    )

print(client.sanitize_for_serialization(response))

import { Configuration, AccountAPIKeysApi } from "cs2cap";

const accessToken = process.env.CS2C_API_KEY;

if (!accessToken) {
  throw new Error("Set CS2C_API_KEY before running this example.");
}

const keyId = "YOUR_CHILD_KEY_ID";

const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
const response = await api.deleteSubKey({ keyId });

console.log(response);

key_id

string

required

UUID of the child key to revoke.

Response example

{
  "ok": true,
  "key_id": "cccccccc-cccc-cccc-cccc-cccccccccccc",
  "revoked_at": "2026-03-03T08:12:00+00:00"
}

boolean

Always true on success.

key_id

string

UUID of the revoked key.

revoked_at

string

ISO 8601 timestamp when the key was revoked.

POST /account/sub-keys/:id/reissue

Replaces an active child key and returns the new plaintext key once. The old child key is immediately revoked. Tiers: Quant

curl -sS -X POST \
  -H "Authorization: Bearer $CS2C_API_KEY" \
  "https://api.cs2c.app/account/sub-keys/YOUR_KEY_ID/reissue"

import os

import cs2cap

configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

key_id = "YOUR_CHILD_KEY_ID"

with cs2cap.ApiClient(configuration) as client:
    api = cs2cap.AccountAPIKeysApi(client)
    response = api.reissue_sub_key(
        key_id
    )

print(client.sanitize_for_serialization(response))

import { Configuration, AccountAPIKeysApi } from "cs2cap";

const accessToken = process.env.CS2C_API_KEY;

if (!accessToken) {
  throw new Error("Set CS2C_API_KEY before running this example.");
}

const keyId = "YOUR_CHILD_KEY_ID";

const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
const response = await api.reissueSubKey({ keyId });

console.log(response);

key_id

string

required

UUID of the child key to reissue.

Response example

{
  "key": "sk_live_<xxxx>",
  "key_info": {
    "id": "dddddddd-dddd-dddd-dddd-dddddddddddd",
    "key_prefix": "sk_live_child",
    "name": "research-bot",
    "root_key_id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
    "is_root_key": false,
    "is_active": true,
    "created_at": "2026-03-03T08:15:00Z",
    "last_used_at": null,
    "expires_at": null,
    "quota_requests_per_month_override": 50000,
    "rate_requests_per_minute_override": 120,
    "effective_quota_requests_per_month": 50000,
    "effective_rate_requests_per_minute": 120
  },
  "message": "Store this key securely. It will not be shown again."
}

key

string

The new plaintext child key value. Shown only once.

key_info

object

Updated metadata for the reissued key. Overrides and name are preserved from the old key.

The new plaintext key is returned once only. Copy and store it securely before closing the response.

Overview

Market Data

Analytics

Portfolio

Account

Sub-Keys API: Create Child API Keys (Quant)

GET /account/sub-keys

POST /account/sub-keys

GET /account/sub-keys/:id

PATCH /account/sub-keys/:id

DELETE /account/sub-keys/:id

POST /account/sub-keys/:id/reissue

​GET /account/sub-keys

​POST /account/sub-keys

​GET /account/sub-keys/:id

​PATCH /account/sub-keys/:id

​DELETE /account/sub-keys/:id

​POST /account/sub-keys/:id/reissue

GET /account/sub-keys

POST /account/sub-keys

GET /account/sub-keys/:id

PATCH /account/sub-keys/:id

DELETE /account/sub-keys/:id

POST /account/sub-keys/:id/reissue