How to create an API key on Xoibit
Last updated:
To create an API key, open API keys, choose the permissions the key needs, optionally restrict it to trusted IP addresses, and confirm with a verification code. Copy the secret straight away: it is shown only once.
Step by step
- Open API keys and choose to create a key.
- Give it a name you will recognise.
- Choose the permissions (see below). Pick only what your app needs.
- Choose the IP restriction: unrestricted, or only trusted IPs that you list.
- Optionally set an expiry date, after which the key stops working.
- Confirm with a verification code.
- Copy the public key and secret and store them safely.
The secret is shown once and cannot be shown again. If you lose it, delete the key and create a new one. Never share your secret or put it in public code.
Which permissions can a key have?
- read_wallet: read wallet balances.
- read_spot / write_spot: read spot orders, and place or cancel spot orders.
- read_futures / write_futures: read futures data, and place or cancel futures orders.
Write permissions let the key trade with your funds. Restricting the key to trusted IPs is strongly recommended for any key with write permissions. The number of keys per account is limited.
How do I sign a request?
Private endpoints under /api/v1/wallets, /api/v1/spot and /api/v1/futures need four headers:
- x-public-key: your public key.
- x-timestamp: the current time in milliseconds. It must be within 60 seconds of the server time.
- x-nonce: a new UUID v4 for every request that is not GET.
- x-signature: an HMAC-SHA256 signature in hex, made with your secret.
For GET requests, sign the method + path + body + timestamp. For other requests, add the nonce as well. The path is signed without the query string.
Public endpoints
Market data under /api/v1 needs no key: ticker, ticker/price, summary, assets, orderbook/{pair} and trades/{pair}.
Why do I get HTTP 429?
Each key has a per-minute request limit. Over the limit, requests return HTTP 429. Slow down and retry after a short wait.
Managing keys
On API keys you can edit a key, turn it on or off, delete it, or block or delete all keys at once if you think one has leaked.
SSS
I lost my API secret. Can I see it again?
No. The secret is shown only once. Delete the key and create a new one.
Why is my signature rejected?
Check that the timestamp is in milliseconds and within 60 seconds, the path has no query string, the nonce is a new UUID v4 for non-GET requests, and the signature is hex HMAC-SHA256.