KalshiTitle / Summary: API key generation produces unusable keypairs — every generated key returns INCORRECT_API_KEY_SIGNATURE Description: I'm experiencing what appears to be a platform-level bug in API key generation. Every API keypair I generate from the production dashboard is rejected by your API with HTTP 401 INCORRECT_API_KEY_SIGNATURE, even when used immediately after generation. Steps to reproduce: Log into kalshi.com production dashboard Navigate to Settings → API Keys Revoke all existing keys Generate a new API keypair (download .pem + copy Key ID) Use the keypair to sign any standard authenticated request (e.g. GET /trade-api/v2/portfolio/balance) with RSA-PSS SHA-256 per Kalshi's published signing reference Request is rejected with INCORRECT_API_KEY_SIGNATURE What I've tested: Generated 3 separate fresh keypairs in clean browser sessions today — all 3 rejected identically Confirmed each keypair is genuinely different (different public-key fingerprints) Tested against all 4 Kalshi hosts (external-api.kalshi.com, api.elections.kalshi.com, and both demo hosts) — production hosts return signature error, demo hosts correctly return NOT_FOUND Signing implementation matches your published Python/Go reference exactly (RSA-PSS, SHA-256, salt length = digest length, message = {timestamp_ms}{method}{path}) Account is KYC-verified, has cash balance, can trade normally through the web UI Expected behavior: Newly generated API keys should authenticate successfully. Actual behavior: All newly generated keys are rejected, suggesting the public key your auth service has registered against the Key ID does not match the private key the dashboard provided to me. Impact: This blocks all API access on my account. Other users may be affected. Account email: melsalawy@gmail.com Latest Key ID prefix: 13b1…5296 Public key fingerprint (SHA-256, first 16 hex): 2358e7f26eef17ef Happy to provide a raw signed request sample or any other debugging info. Thanks,
Title / Summary: API key generation produces unusable keypairs — every generated key returns INCORRECT_API_KEY_SIGNATURE Description: I'm experiencing what appears to be a platform-level bug in API key generation. Every API keypair I generate from the production dashboard is rejected by your API with HTTP 401 INCORRECT_API_KEY_SIGNATURE, even when used immediately after generation. Steps to reproduce: Log into kalshi.com production dashboard Navigate to Settings → API Keys Revoke all existing keys Generate a new API keypair (download .pem + copy Key ID) Use the keypair to sign any standard authenticated request (e.g. GET /trade-api/v2/portfolio/balance) with RSA-PSS SHA-256 per Kalshi's published signing reference Request is rejected with INCORRECT_API_KEY_SIGNATURE What I've tested: Generated 3 separate fresh keypairs in clean browser sessions today — all 3 rejected identically Confirmed each keypair is genuinely different (different public-key fingerprints) Tested against all 4 Kalshi hosts (external-api.kalshi.com, api.elections.kalshi.com, and both demo hosts) — production hosts return signature error, demo hosts correctly return NOT_FOUND Signing implementation matches your published Python/Go reference exactly (RSA-PSS, SHA-256, salt length = digest length, message = {timestamp_ms}{method}{path}) Account is KYC-verified, has cash balance, can trade normally through the web UI Expected behavior: Newly generated API keys should authenticate successfully. Actual behavior: All newly generated keys are rejected, suggesting the public key your auth service has registered against the Key ID does not match the private key the dashboard provided to me. Impact: This blocks all API access on my account. Other users may be affected. Account email: melsalawy@gmail.com Latest Key ID prefix: 13b1…5296 Public key fingerprint (SHA-256, first 16 hex): 2358e7f26eef17ef Happy to provide a raw signed request sample or any other debugging info. Thanks,