API Keys of Major Cryptocurrency Exchanges: Examples & Uses

An exchange API key is a set of credentials, usually a public key that identifies your account plus a secret that signs each request, that lets a program trade, read balances or pull market data on your exchange account without your password. Each exchange issues its own format and signs requests its own way, and each lets you limit what a key may do. Below: what the credentials look like on Binance, Coinbase, Kraken, Bitfinex and HTX, how bots use them, and how to keep them from becoming a back door into your account.

Exchange API Keys at a Glance

Exchange API credentials are not interchangeable: each exchange issues its own set of values and signs requests differently. The examples below are the placeholder values the exchanges publish in their own documentation, so they are safe to show; never publish real keys.

What Is an API Key?

An API key is a unique identifier used to authenticate requests from a user or an application to the services an exchange provides. Exchanges use them so that third-party applications can access your account without your login credentials, and only within the permissions you grant. On most exchanges the key comes as a pair: the public part travels with every request, while the secret never leaves your machine and is used only to compute a signature.

Why Are API Keys Important?

API keys are essential for:

• Automated trading: Bots need API keys to place buy or sell orders on your behalf.

• Portfolio management: External tools track portfolio performance through your exchange’s API.

• Market data: APIs provide real-time prices, trading volumes and order book data.

Examples of API Keys for Major Cryptocurrency Exchanges

1. Binance

Binance offers three key types. For an HMAC key, Binance generates both values: an API key, sent in the X-MBX-APIKEY header, and a secret key used to sign each request with HMAC-SHA256. The keys in Binance’s request security documentation are 64 letters and digits long:

API Key:    vmPUZE6mv9SD5VNHk4HlWFsOr6aKE2zvsw0MuIgwCIPy6utIco14y7Ju91duEh8A
Secret Key: NhqPtmdSJYdKjVHjA7PZj4Mge3R5YNiP1e3UZjInClVN65XAbvqqM6A7H5fATj0j

Binance’s API key FAQ marks HMAC keys as deprecated and recommends Ed25519 keys. With Ed25519 or RSA you share only your public key with Binance and keep the private key, which signs your requests, on your own computer.

Binance API keys let applications check balances, place and cancel orders and read market data, within the permissions you grant. Trading is off by default: a new key cannot trade until you enable it in API Management.

2. Coinbase

Coinbase Developer Platform (CDP) keys do not sign requests directly. The private key signs a short-lived JSON Web Token (JWT), valid for 2 minutes, which is sent as a Bearer token. Coinbase’s JWT authentication guide calls ECDSA a legacy algorithm and recommends Ed25519 keys, whose secret is base64 text encoding 64 bytes: a 32-byte seed followed by the public key. The Coinbase App APIs still require ECDSA (ES256) keys, which consist of a key name and a PEM private key:

Key name:    organizations/{org_id}/apiKeys/{key_id}
Private key: -----BEGIN EC PRIVATE KEY-----
             ...
             -----END EC PRIVATE KEY-----

Coinbase Exchange (formerly Coinbase Pro) still uses a different scheme: an API key, a base64 secret and a passphrase you choose, sent in the CB-ACCESS-KEY, CB-ACCESS-SIGN, CB-ACCESS-TIMESTAMP and CB-ACCESS-PASSPHRASE headers, with HMAC-SHA256 signatures (Coinbase Exchange authentication). Coinbase stores only a salted hash of the passphrase, so it can’t be recovered if you forget it.

3. Kraken

Kraken issues an API key, sent in the API-Key header, and a private key that is never transmitted. According to Kraken’s REST authentication guide, each request is signed with HMAC-SHA512 over the URI path and a SHA-256 hash of the nonce and POST data, using the base64-decoded private key; the nonce must increase with every request. This is the private key from that guide, 88 base64 characters encoding 64 bytes:

Private Key: kQH5HW/8p1uGOVjbgWA7FunAmGO8lsSUXNsu3eow76sz84Q18fWxnyRzBHCd3pd5nE9qa99HAZtuZuj6F1huXg==

Kraken’s API covers spot trading, funding and margin, and keys can be limited to specific actions.

4. Bitfinex

Bitfinex API v2 uses an API key and an API secret. Its documentation shows no example values, only how a signed request is built: three headers carry the key, an ever-increasing nonce and the signature, computed with HMAC-SHA384 over the URL path, the nonce and the JSON body (Bitfinex authenticated request example). In Python that takes nothing beyond the standard hmac and hashlib modules, the same ones our BIP39 seed phrase script in Python relies on.

bfx-apikey:    <API key>
bfx-nonce:     <increasing timestamp in milliseconds>
bfx-signature: hex(HMAC-SHA384(API secret, "/api/v2/<endpoint>" + nonce + JSON body))

Bitfinex’s API provides real-time data streams, account management and trading.

5. HTX (formerly Huobi)

HTX, the exchange formerly known as Huobi, issues an access key, used in each request, and a secret key, shown only once when it is created. Requests are signed with HMAC-SHA256 and the signature is base64-encoded. The HTX API documentation shows keys masked like this:

AccessKeyId=e2xxxxxx-99xxxxxx-84xxxxxx-7xxxx

The same documentation strongly suggests binding each key to an IP address and notes that a key without an IP binding expires after 90 days. HTX’s API gives access to trading, market data and wallet functions.

How API Keys Are Used in Trading

API keys let users automate trading, portfolio management and market analysis. They are particularly useful for:

• Bot trading: Trading bots need keys to execute trades based on predefined strategies without human intervention.

• Data retrieval: APIs pull real-time data for analysis, such as prices, volumes and market trends.

• Controlled access: A key carries only the permissions you assign, so a portfolio tracker can read balances without being able to trade.

While a bot trades, your funds stay on the exchange, which holds the keys to them; crypto exchange vs wallet explains what that means if the exchange fails.

Security Tips for Using API Keys

• Never enable withdrawals unless you must. A key that can only trade or read can’t send your coins to someone else’s address. Most bots and trackers need no withdrawal permission at all.

• Grant the minimum permissions. Restrict keys to read-only if you don’t need trading. Binance, for example, creates keys that cannot trade until you enable it.

• Bind keys to IP addresses. Allow requests only from your server’s IP addresses. HTX goes further and expires keys that have no IP binding after 90 days.

• Keep the secret secret. Never share your keys. Store them in a password manager, a secrets manager or an encrypted file, never in code or a public repository. The same rules apply to other API secrets, such as OpenAI API keys and Anthropic API keys.

• Prefer asymmetric keys where offered. With Ed25519 or RSA keys on Binance, you keep the private key and share only the public one, so a leak on the exchange’s side can’t expose your signing key.

• Be wary of anyone asking for keys. “Copy-trading” services, bot sellers and fake support agents who ask for a key with withdrawal rights are running a scam, the API-key cousin of wallet phishing.

• Rotate and review. Delete keys you no longer use, rotate active ones regularly, and check the exchange’s API activity log for requests you don’t recognize.

For more information on API keys, check the official documentation on your exchange’s website, linked in each section above. More code and key-handling guides are collected in our developer guides.

Frequently Asked Questions

Can someone steal my crypto with my API key?

Only if the key has withdrawal permission, or if it can trade and the attacker uses it to move your funds through manipulated trades. A read-only key exposes your balances and history but can’t move coins. That is why withdrawal rights should stay off and keys should be tied to your IP addresses.

What is the difference between an API key and an API secret?

The API key identifies you and travels with every request, much like a username. The secret, or private key, never travels: it signs each request so the exchange can verify it came from you. Treat both as sensitive, though: Binance’s documentation warns never to share either one.

Do I need an API key to use an exchange?

No. API keys are for programs. You need one only if you connect a bot, a portfolio tracker, tax software or your own code to your account.