API keys and the REST trading API

Last updated: 2026-10-15

Create an API key

1. Open API keys and create a key (a verification code is needed).
2. Choose only the permissions you need: read_wallet, read_spot, write_spot, read_futures, write_futures.
3. Restrict the key to your server's IP addresses when you can.
4. Copy the secret now. It is shown only once and cannot be shown again.

The number of keys per account is limited. You can edit, disable or delete a key at any time.

Sign your requests

Private endpoints need four headers: x-public-key, x-timestamp (milliseconds), x-signature and x-nonce.

• Signature = HMAC-SHA256 of the request with your secret, hex-encoded.
• For GET: METHOD + path + body + timestamp. For other methods: METHOD + path + body + timestamp + nonce.
• The path is the URL path without the query string; the body is the JSON body, or empty.
• The timestamp must be within 60 seconds of server time.
• For non-GET requests the nonce must be a new UUID v4 every time.

Endpoints

• Public market data, no key needed: /api/v1/ticker, /api/v1/ticker/price, /api/v1/summary, /api/v1/assets, /api/v1/orderbook/{pair}, /api/v1/trades/{pair}.
• Wallets: /api/v1/wallets/overview and /api/v1/wallets/{wallet_type}.
• Spot and futures: /api/v1/spot and /api/v1/futures (orders, trades, cancel).

Rate limits

Requests are limited per account per minute. If you go over the limit you get HTTP 429 and must wait before trying again. Every authenticated request is logged.

Never share your secret or put it in client-side code. Delete a key at once if you think it has leaked.