API Key
An API key is a string that lets an outside program reach your pool account or your asic. The key works without a password.
What an API key is
Monitoring, a messenger bot, a panel for several asics: all of them need access to your data. Instead of handing over a login with a password, the service asks for an API key. The pool issues it in the settings, and from then on the program talks to the pool in your name.
Keys differ in rights. A read only key shows statistics and nothing more, while a key with write rights can change settings and sometimes the payout address. Monitoring needs the first kind, and there is no reason to give the second to a service that only draws charts.
A leaked read key means your statistics are out in the open, and a leaked write key can end with payouts going to somebody else's address. Hence simple hygiene: one key per service, minimum rights, and revoke a key the moment the service stops being useful to you.
The asic itself also has its own access over the network, and the logic there is the same. A web interface with the factory password must never face the internet, and inside your own network the password is still worth changing: the factory pairs are known to everyone.
Quick reference table
| What it is | a string that lets a program reach your data |
| Where it is issued | in the pool or service settings |
| Rights | read only, or read and write |
| What monitoring needs | read only |
| After a leak | the key gets revoked and a new one issued |
Rules that save you grief
One service, one key. Then a leak costs you exactly one access to revoke instead of reconnecting everything you set up over a year.
Watch what a service asks for. If a monitoring panel demands rights to change settings, that is a reason to be wary: charts need reading only.
Never send keys in a chat and never keep them in phone notes. And remember that your key is of no use to us, to the pool or to an exchange: any such request is an attempt to trick you.
An example
Three asics, a monitoring panel and a bot with alerts. The panel gets a read key, the bot gets a read key of its own, and write rights go to nobody. Six months later the panel gets swapped for another one: the old key is revoked and the rest keeps working.
Related terms
Where to go next on the site
Hardware
- ASIC Miner knowledge base
Software
- HashCore Toolkit firmware
- Software firmware
Questions and answers
How is an API key different from a password
A password lets a person into an account, while a key lets a program in, usually with limited rights. A key can be revoked without changing the password.
Is it dangerous to give a key to monitoring
A read only key shows statistics and allows no changes to settings. The risk here is disclosure of data rather than loss of money.
What should you do after a leak
Revoke the key in the pool settings and issue a new one. Check the payout address and the history of setting changes while you are there.
How the terms connect
Every link in the chain is clickable. Orange marks where you are now.
Looking for an ASIC miner
The catalog holds 212 models. You can compare them by hashrate and by joules per terahash, then plug your own rate into the calculator and see what stays in your pocket.
Page written and checked by Denys Klimchuk. Updated .