📘

Note

1. For existing API key:
   1. Existing organisation on Vaults having an active API key will have Full Access role assigned to it.
   2. Full access role has the following permissions:
      1. Read and Write wallet operations,
      2. Read and write transaction operations (including transaction initiation and signing), and
      3. Enable MPC setup for a Signer. Refer to this guide for MPC setup.
   3. You can rotate, disable, whitelist address and delete an existing active API key with Full Access role in your Vaults organisation. Refer to this guide for managing API key.
2. Signer key:
   1. An API key with Signer user role needs to set-up required RSA key and MPC shard import operations before the user can actively start approving and signing transactions.
   2. When creating the Signing API Key, until the shard sharing is completed by the Owner to the API Key and it appears as API Signer Status under Users section you will not be able to complete the creation of another signer key.
3. For new Vaults organisations: Vaults’ organisations created post May 15, 2026 and having either Express v1.3.18 or higher, will need to have at least one API key with Initiator and Signer roles each to complete a transaction.
4. Enterprise organisations can request for a higher API key limit than the current limit of 5 key per organisation. Reach out to support for assistance.

🚧

Migration Guide from Single Full Access API Key to Multiple API Keys with different Roles

1. Create a unique email address for each API Key user
2. V2 Wallet Transactions require two separate keys:

Initiator Key for use with the send-many-transaction API Signer Key for use with the submit-transaction API

3. V1 Wallet Transactions require one key to complete a transaction

Signer Key for use with the send-many-transaction API only

Migrating from a Full Access Key Follow this sequence carefully to ensure zero downtime:

a. Upgrade Liminal Express to v1.3.18 or above first

b. Do not delete the existing Full Access Key

c. Create your new Signer Key and Initiator Key Make code changes in your dev environment first
d. Thoroughly test all transactions Only then, delete the Full Access Key

⚠️ Breaking Change — send-many-transaction API :The amount field now accepts a string instead of a number.

❗️

Using the initiator role to call the submit transaction api will return successful. This is expected since the response simply acts as an acknowledgement, the processing happens asynchronously at the backend. However the processing will fail at the backend and the initiator will not be able to sign.

We are also working on improving the error messages related to RBAC errors.