> For the complete documentation index, see [llms.txt](https://docs.reya.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.reya.xyz/developers/devnet/getting-started/signer-authorization.md).

# Signer Authorization

Order-management requests are authorised by an EIP-712 signature from a wallet permitted to trade for your account. Manage signer permissions with your owner wallet in the environment you intend to use.

## Owner wallet, signer, and accounts

* Your **owner wallet** owns your [accounts](/developers/devnet/getting-started/accounts-and-subaccounts.md).
* A **signer** produces the EIP-712 signatures on your orders (see [Signatures & Nonces](/developers/devnet/authentication/signatures-and-nonces.md)). The signer must be permissioned to act for the account it trades on — an "invalid signature" / "not permissioned" error usually means the signer isn't authorised for that `accountId`.

## Authorise a signer

A signer is authorised to act for an account **per environment**. On devnet1, connect the account's owner wallet to the [API Keys page](https://app-devnet-cf.reya.xyz/api-page) to add or remove authorised signer wallets. You can authorise **more than one** signer for the same account; orders signed by any currently authorised signer are accepted for that account.

For programmatic signer management, the TypeScript SDK (`@reyaxyz/sdk`) provides `enableApiWallet` and `disableApiWallet`. Pass the owner's `signer` and the additional signer's public address as `apiWalletAddress`, with the SDK configured for the intended environment.

{% hint style="info" %}
**There are no API keys.** Reya issues no API keys or bearer tokens — your credential is the **signer wallet keypair you generate and hold**, and every order is authorised by an EIP-712 signature from it (see [Signatures & Nonces](/developers/devnet/authentication/signatures-and-nonces.md)). An "API key", in Reya's model, is simply an **additional authorised signer wallet**: you generate the keypair, and you authorise its **public address** — you never share a private key.
{% endhint %}

The dApp calls these signers "API keys", but the page manages on-chain signer permissions: enter the **public address** of each signer you generated and never share its private key. Signer management is environment-specific, so use the devnet1 page above only for devnet1 accounts.

Each signer has its own nonce sequence. REST and WebSocket Order Entry share that sequence for the same signer, so switching transports does not create a second nonce stream. If you need independently concurrent order submission, authorise multiple signers and allocate nonces independently per signer; see [Signatures & Nonces](/developers/devnet/authentication/signatures-and-nonces.md#nonces).