Three developer surfaces. The two REST APIs share one base URL (https://trade.mutex.trade) and one auth scheme. Every endpoint shape is in the live OpenAPI spec - the pages below are the narrative, the reference is the truth.
Every authed route takes Authorization: Bearer <key>. These docs cover three kinds, all issued display-once in the web app:
A trading key on an affiliate route is 403 wrong_key_kind, and so is any key on a route meant for another kind. Public market data (/v1/markets, /v1/candles) needs no key at all:
curl https://trade.mutex.trade/v1/markets
Neither the trading key nor the affiliate key can deposit, withdraw, swap or transfer, and neither can touch your main perp account. Funding, payouts and settings stay in the web app on purpose - the blast radius of a leaked key is one bot's balance, or read-only referral stats.
On this API, the agent key moves money only between your Funding balance and Predictions, and Prediction money only ever comes back to Funding. What else it can do as you is on the Agent access page.