# Crypto exchange API guides for developers

URL: https://fincodelabs.com/en/blog/crypto-exchange-apis · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Updated: 2026-11-06

How exchange APIs work, how to create and protect keys, and exchange-by-exchange Python notes on signing, test environments, rate limits and WebSocket streams.

**Short answer:** A crypto exchange API lets software read market data and, with a signed request, act on your own account. Most integrations need the same pieces: a key with limited permissions, request signing, rate limit handling and a WebSocket stream for live data. Signing and test environments differ by exchange, so check the platform's own documentation before you build.

Start with what a crypto API is and how an integration is put together, then read the notes for the platform you use. The later groups cover rate limits, error codes, live order books and shared libraries such as CCXT.

The guides describe each platform's official documentation, read on the date given in each guide, and do not recommend one over another. Availability depends on your jurisdiction and each platform's terms. For readers in Turkey, Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized.

## Start here: keys and how an integration works

What the different kinds of crypto API do, how an integration is put together, and how to create, sign with and protect a key.

- [What is a crypto API? Exchange, data and wallet APIs](https://fincodelabs.com/en/blog/what-is-crypto-api): What is a crypto API? Exchange, market data, node and wallet, and payment APIs explained, what an API key can do, free versus paid, and the rules that apply.
- [Crypto exchange API integration: REST, WebSocket, limits](https://fincodelabs.com/en/blog/crypto-exchange-api-integration): Crypto exchange API integration explained: REST vs WebSocket, request signing, clock sync, rate limits, client order IDs, retries and testnets.
- [Binance API key: how to create one, plus 7 other exchanges](https://fincodelabs.com/en/blog/exchange-api-key-how-to): How to create a Binance API key, plus Coinbase, Kraken, Bybit, OKX, KuCoin, Bitget and MEXC: dated steps from official pages, permissions, IP rules and errors.
- [Binance API key setup: permissions, IP rules and rotation](https://fincodelabs.com/en/blog/binance-api-key): Binance API key setup, checked 6 November 2026: where to create it, each permission, IP and expiry rules, HMAC vs Ed25519, a tested key check and leak steps.
- [API key security for trading bots: permissions, storage](https://fincodelabs.com/en/blog/api-key-security-trading-bots): API key security for trading bots: trade-only permissions, no withdrawals, IP allowlists, one key per bot, secret storage, rotation, safe logs, leak response.
- [Ed25519 API key: create, sign and migrate off HMAC](https://fincodelabs.com/en/blog/ed25519-api-key): Ed25519 API key guide: generate the pair, register the public key, sign Binance requests, fix -1022 and -2015 errors and move a bot off HMAC.

## Exchange by exchange, in Python

Hosts, signing, test environments, rate limits and WebSocket notes from each platform's own documentation, in alphabetical order.

- [Binance API documentation: base URLs, testnets, conflicts](https://fincodelabs.com/en/blog/binance-api-documentation): Binance API documentation, read 6 November 2026: where Spot, futures, options and portfolio margin docs live, base URLs, testnets, SDKs and conflicts.
- [Binance API Python trading bot: a testnet-first guide](https://fincodelabs.com/en/blog/binance-api-python-trading-bot): Binance API Python guide on the Spot Testnet: exchange filters, Ed25519 signed requests, test and live orders, order status, user data stream, error codes.
- [BingX API in Python: signing, VST demo and error codes](https://fincodelabs.com/en/blog/bingx-api-python): BingX API Python guide, docs read 6 Nov 2026: X-BX-APIKEY and HMAC signing, rate limits, error codes, the VST demo host and tested code.
- [Bitget API in Python: UTA v3 signing, demo and WebSocket](https://fincodelabs.com/en/blog/bitget-api-python): Bitget API Python guide, docs read 5 Nov 2026: four ACCESS headers, HMAC signing, demo trading with paptrading, WebSocket URLs, rate limits, tested code.
- [Bitvavo API Python: signing, weight limits and error codes](https://fincodelabs.com/en/blog/bitvavo-api-python): Bitvavo API in Python, read 6 Nov 2026: HMAC signing, operatorId, the 1,000-point weight limit, error codes, the WebSocket order book and tested code.
- [Bybit API in Python: V5 signing, testnet and rate limits](https://fincodelabs.com/en/blog/bybit-api-python): Bybit API Python guide for V5: testnet and demo hosts, HMAC signing, order calls, rate limits, the too many visits error and a tested WebSocket order book.
- [Coinbase Advanced Trade API in Python: JWT, orders, limits](https://fincodelabs.com/en/blog/coinbase-advanced-trade-api-python): Coinbase Advanced Trade API Python guide: ES256 JWT signing, tested public and sandbox calls, the official SDK, rate limit facts and what the sandbox misses.
- [Crypto.com API: Exchange v1 keys, signing and limits](https://fincodelabs.com/en/blog/crypto-com-exchange-api): Crypto.com Exchange API v1, read 6 Nov 2026: API key setup, the exact HMAC signing string, rate limits that conflict, the UAT sandbox and tested Python.
- [Deribit API Python: testnet, API keys and rate limits](https://fincodelabs.com/en/blog/deribit-api-python): Deribit API in Python, tested on test.deribit.com: JSON-RPC over HTTP and WebSocket, API keys and scopes, heartbeats, book sync and credit limits.
- [Gate.io API in Python: v4 signing, TestNet and WebSocket](https://fincodelabs.com/en/blog/gate-io-api-python): Gate.io API v4 in Python, docs read 5 Nov 2026: HMAC-SHA512 signing, the 60-second clock window, TestNet hosts, rate limits, WebSocket, tested code.
- [Kraken API in Python: nonce, signing and rate limits](https://fincodelabs.com/en/blog/kraken-api-python): Kraken API Python guide: API-Sign test vector, nonce rules, rate limit exceeded errors, Spot UAT and the futures demo status, Derivatives auth and WebSocket v2.
- [Kraken Futures API: Authent, PF_ symbols and demo status](https://fincodelabs.com/en/blog/kraken-futures-api): Kraken Futures API read 5 Nov 2026: REST map with costs, Authent and challenge signing tested, PF_ symbols after the inverse delisting, demo status.
- [OKX API in Python: passphrase, demo trading and limits](https://fincodelabs.com/en/blog/okx-api-python): OKX API Python guide: key and passphrase, Base64 HMAC signing, demo trading with x-simulated-trading, error 50119, rate limits, WebSocket and the API Agreement.
- [Turkish crypto exchange APIs: BtcTurk, Binance TR, Paribu](https://fincodelabs.com/en/blog/turkish-crypto-exchange-apis): Turkish crypto exchange APIs from official docs: BtcTurk, Binance TR, Paribu, OKX TR, Bybit, Bitlo and Bitexen base URLs, signing, rate limits and API terms.

## Decentralized exchanges and swap APIs

On decentralized exchanges and swap services, an order or a swap is signed with a wallet key, even where the service also issues an API key for access to its servers.

- [Hyperliquid API in Python: API wallets, signing, limits](https://fincodelabs.com/en/blog/hyperliquid-api-python): Hyperliquid API Python guide on testnet: the official SDK, API wallets, L1 and user-signed actions, nonce rules, rate limits, WebSocket and private-key risk.

## Rate limits and errors

What to do when a request is rejected: error codes, key and permission problems, nonces and rate limits.

- [Kraken API invalid nonce: causes and multi-process fixes](https://fincodelabs.com/en/blog/kraken-api-invalid-nonce): Kraken API invalid nonce explained from Kraken's own pages: why shared keys, retries and clock steps break the nonce, and fixes tested across processes.
- [Binance API error codes: -1021, -1022, -2015 and fixes](https://fincodelabs.com/en/blog/binance-api-error-codes): Binance API error codes: what -1021, -1022, -2015, 429, 418 and 451 mean, what to check first, and a signing and clock check tested on the Spot Testnet.
- [API rate limit exceeded: fixes for 12 crypto exchanges](https://fincodelabs.com/en/blog/api-rate-limit-exceeded-crypto-exchanges): API rate limit exceeded? Limits, scopes, exact error codes and penalties for 12 crypto exchanges from their official docs, plus a tested Python fix.
- [Binance API rate limit: weights, order counts and bans](https://fincodelabs.com/en/blog/binance-api-rate-limit): Binance API rate limit: Spot 6,000 and USD-M 2,400 request weight a minute (read 4 Nov 2026), per-account order counts, 429 and 418 bans, tested Python tracker.
- [Token bucket rate limiter in Python, with measured 429s](https://fincodelabs.com/en/blog/token-bucket-rate-limiter-python): A token bucket rate limiter in Python for exchange APIs: thread, asyncio and multi-process code, weights, Retry-After, and real 429 counts from a local mock.
- [Exponential backoff with jitter in Python: tested retries](https://fincodelabs.com/en/blog/exponential-backoff-jitter-python): Exponential backoff with jitter in Python: full, equal and decorrelated formulas simulated, strict Retry-After parsing, and safe retries for timed-out orders.

## Live streams and order books

Streams and reconnects, what order book data contains and how to keep a live book correct when a connection drops.

- [Local order book via WebSocket: snapshot and diff sync](https://fincodelabs.com/en/blog/websocket-order-book): How to maintain a local order book from WebSocket streams: Binance snapshot plus diff sync, update IDs, gap detection, Kraken checksums, tested Python.
- [Level 2 order book data: free feeds, depth limits, costs](https://fincodelabs.com/en/blog/level-2-order-book): Level 2 order book data explained: L1 vs L2 vs L3, free depth limits of five crypto APIs read 6 Nov 2026, gap recovery, data terms and stock L2 fees.
- [WebSocket heartbeat and reconnect in Python for trading](https://fincodelabs.com/en/blog/websocket-heartbeat-reconnect): WebSocket heartbeat vs ping pong, five exchanges' documented timers against measured ones, a tested Python reconnect loop with a stale-feed watchdog and jitter.
- [Binance WebSocket API and streams: limits and reconnects](https://fincodelabs.com/en/blog/binance-websocket-api): Binance WebSocket Streams and WebSocket API compared: URLs, limits, ping and pong, 24-hour disconnects, serverShutdown and a reconnect loop tested on testnet.
- [Binance API user data stream: listenKey, subscribe, events](https://fincodelabs.com/en/blog/binance-user-data-stream): Binance API user data stream: Spot listenKey retired (HTTP 410), userDataStream.subscribe, USD-M listenKey, events and Python tested on a local mock.
- [MEXC WebSocket API in Python: protobuf and Blocked errors](https://fincodelabs.com/en/blog/mexc-websocket-python): MEXC WebSocket in Python, tested 5 November 2026: why subscriptions return Blocked, compiling the protobuf files, decoding streams and depth versions.
- [Order book imbalance formula: OBI, OFI and edge cases](https://fincodelabs.com/en/blog/order-book-imbalance-formula): Order book imbalance formula: (bid - ask) / (bid + ask) by levels or price band, weighted variants, how OFI differs, and tested Python for the edge cases.

## Prices and historical data

Current prices and past candles, trades and funding rates come from exchange endpoints, price aggregators, bulk files and paid data vendors, each with its own limits and terms.

- [Crypto price API: live, historical and OHLCV data](https://fincodelabs.com/en/blog/crypto-price-api): Crypto price API guide: exchange endpoints, aggregators and tick vendors, pricing checked in November 2026, tested Python for OHLCV candles, gaps and licenses.
- [Crypto historical data download: sources, caps, licenses](https://fincodelabs.com/en/blog/crypto-historical-data-download): Crypto historical data download: exchange candle caps and bulk files tested 6 Nov 2026, the license each source states, and Python that writes a checked CSV.
- [Binance historical data API: REST klines vs zip archives](https://fincodelabs.com/en/blog/binance-historical-data-api): Binance historical data API, tested 5 November 2026: klines paging, intervals, USD-M mark price candles, data.binance.vision zips, checksums, microseconds.
- [Funding rate history API: open interest, liquidation data](https://fincodelabs.com/en/blog/funding-rate-history-api): Funding rate history API by venue, tested 5 Nov 2026: rows, page limits and traps, Binance's one-month open interest limit, why liquidation feeds undercount.

## Test environments

What each platform offers for testing without real money, from its own documentation.

- [Binance Futures testnet API key: two hosts, one demo market](https://fincodelabs.com/en/blog/binance-futures-testnet-api-key): Binance Futures testnet API key as of 5 November 2026: creating it on demo.binance.com, demo-fapi vs the old host, the SDK, and tested Python code.
- [Coinbase sandbox: Exchange vs Advanced Trade vs Checkouts](https://fincodelabs.com/en/blog/coinbase-sandbox): Coinbase sandbox explained: the Exchange sandbox login, keys and fake funds, the mocked Advanced Trade sandbox, Checkouts, and what each one can prove.
- [KuCoin sandbox in 2026: status and Python API testing](https://fincodelabs.com/en/blog/kucoin-sandbox-api-python): Is there a KuCoin sandbox? Status checked 5 November 2026, and how to test the KuCoin API in Python: signing, order test, rate limits and WebSocket drops.

## Orders in detail

The order fields and types that cause most rejected or duplicated orders.

- [Client order ID: idempotent orders on exchanges and FIX](https://fincodelabs.com/en/blog/client-order-id): Client order ID rules compared: Binance, Bybit, Coinbase, Kraken, OKX, Hyperliquid, Alpaca and FIX tag 11, the retry trap after a fill, and tested Python.
- [Time in force: GTC, IOC, FOK and post only in trading APIs](https://fincodelabs.com/en/blog/time-in-force): Time in force explained: GTC, IOC, FOK, GTD and post only mapped across seven exchange APIs and FIX tag 59, with failure behavior and a tested Python mapper.
- [Reduce only order: meaning, rejections and API fixes](https://fincodelabs.com/en/blog/reduce-only-order): Reduce only order meaning, why reduceOnly orders are rejected on Binance, Bybit and others, error codes -2022 and -4118, and a tested Python fix flow.
- [OCO order: how it works and how to place one by API](https://fincodelabs.com/en/blog/oco-order): OCO order meaning with an example, Binance Spot POST /api/v3/orderList/oco, USD-M conditional orders in the Algo Service, and a tested Python emulation.
- [Iceberg order: display size, refills and API fields](https://fincodelabs.com/en/blog/iceberg-order): Iceberg order explained: display size, why a refill loses queue priority on CME, hidden vs iceberg, and crypto API fields by venue, read 6 November 2026.
- [TWAP order: how slicing works, API fields and tested code](https://fincodelabs.com/en/blog/twap-order): TWAP order explained: how a parent order is sliced, TWAP vs VWAP, native API fields on five venues, what happens on failure, and a tested Python slicer.

## Order state and partial fills

An order moves through states from sent to filled, canceled, rejected or expired, and its fills can arrive in parts, late or more than once, so trading software has to track each step.

- [Order state machine: FIX states, late fills and tests](https://fincodelabs.com/en/blog/order-state-machine): Order state machine for trading code: FIX OrdStatus precedence, Binance, Bybit and Kraken statuses, unknown orders, late fills and tested Python.
- [Partial fill: what it means and how to track it in code](https://fincodelabs.com/en/blog/partial-fill-handling): A partial fill executes only part of an order. How Binance, Bybit, Kraken, Coinbase, Alpaca, IBKR and FIX report fills (6 Nov 2026), with tested Python.

## Several exchanges behind one interface

When a shared library such as CCXT is enough, and when a direct integration is the better fit.

- [CCXT Python: building a multi-exchange trading bot](https://fincodelabs.com/en/blog/ccxt-python-trading-bot): CCXT Python guide: unified markets, fetch_ticker, fetch_ohlcv, precision helpers, sandbox mode, rate limits, errors, CCXT Pro streams and a tested bot skeleton.
- [CCXT rate limit and error handling: what is safe to retry](https://fincodelabs.com/en/blog/ccxt-rate-limit-error-handling): CCXT rate limit and error handling in release 4.5.92: what rateLimit does, which exceptions are safe to retry, why orders are not, and a tested wrapper.

## Signing and test environments at a glance

Private requests are signed differently from one platform to the next: HMAC over a defined string on some, a short-lived JWT or a wallet signature on others. Test environments differ too, and the [crypto exchange API comparison](https://fincodelabs.com/en/exchange-api-comparison) holds the full table with the date each row was read; it is not a ranking or a recommendation.

## Calculators

- [HMAC signature generator: debug exchange API signing](https://fincodelabs.com/en/tools/hmac-signature-generator): Build the exact string an exchange signs, see it byte by byte, get the HMAC in hex and Base64 and compare it with yours. Never paste a live secret into any website, this one included: the tool loads a published sample key. Free, no sign-up required.
- [API rate limit calculator: budget weights and requests](https://fincodelabs.com/en/tools/api-rate-limit-calculator): Enter your API's limit, its window and what your program calls to see the share used per window, the headroom, the largest symbol count that fits and a backoff schedule. Every number is yours. Free, no sign-up required.
- [Crypto trading fee calculator: maker, taker and slippage](https://fincodelabs.com/en/tools/crypto-trading-fee-calculator): Enter the trade size, your maker and taker rates, the share of maker fills, slippage and round trips per month to see what trading costs per round trip and per month. Free, no sign-up required.

## From Fincode

- [Crypto exchange API comparison](https://fincodelabs.com/en/exchange-api-comparison): Crypto exchange API comparison from official docs: signing, rate limits, WebSocket limits, test environments and FIX for 13 platforms, dated 5 November 2026.
- [Exchange API integration checklist](https://fincodelabs.com/en/exchange-api-integration-checklist): An exchange API integration checklist with tests: permissions, signing, clock sync, rate limits, client order IDs, retries, partial fills and reconciliation.
- [Crypto exchange API changes: a dated log](https://fincodelabs.com/en/exchange-api-changes): Dated log of API changes from official changelogs since 1 September 2026, including the Binance API changelog, with who is affected and a source link.
- [Crypto trading glossary: API and trading software terms](https://fincodelabs.com/en/glossary): Glossary of 262 crypto trading and API terms: keys, REST, WebSocket, FIX, rate limits, orders, fills, market data, risk controls, testing and regulation.
- [Crypto exchange API integration services](https://fincodelabs.com/en/services/exchange-api-integration): Connect crypto exchange APIs to your app, bot or internal tool: market data, orders and balances, with rate-limit handling, retries, logs and documentation.
- [Turkish crypto exchange API connectors](https://fincodelabs.com/en/services/turkish-exchange-connectors): API connectors for BtcTurk and other platforms on Turkey's Capital Markets Board list, for foreign fintechs. API terms are checked before we quote.
- [Subcontract crypto API and trading software development for agencies](https://fincodelabs.com/en/services/white-label-development): Exchange connectors, rule-based trading modules and TradingView bridges built as subcontract work for software agencies, with written scope and test reports.
- [API key handling and security practices](https://fincodelabs.com/en/security): How Fincode software handles exchange API keys: read and trade permissions only, no withdrawal rights, IP restriction, your own server by default.

## Frequently asked questions

### What is an API key in crypto, and should it have withdrawal permission?

An API key identifies your software to an exchange and sets what it may do. Trading software needs read and trade permissions only: keep withdrawal permission off, restrict the key by IP where the platform allows it, and use one key per bot.

### When is WebSocket needed instead of REST?

REST suits request and response work such as placing orders, reading balances and fetching history. WebSocket suits streams such as the live order book and fills.

### CCXT or the exchange's API directly?

CCXT is quick for common features across many exchanges. A direct integration fits when you need features or streams the library does not cover.

> These guides are general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms.

## Other guides

- [Trading bots: guides to how they work, cost and hiring](https://fincodelabs.com/en/blog/trading-bots): Guides to crypto trading bots and automated trading software: how bots work, rule types, AI claims, open-source frameworks, running costs and hiring checks.
- [Backtesting and risk guides for trading bots](https://fincodelabs.com/en/blog/backtesting-and-risk): How to test a trading bot without fooling yourself: backtesting pitfalls, Python libraries, paper trading, slippage, funding, risk limits and reconciliation.
- [Algorithmic trading API guides: stocks, forex and FIX](https://fincodelabs.com/en/blog/stock-and-broker-apis): Developer guides to algorithmic trading APIs for stocks, forex and futures, from official documents: access, login, orders, paper trading, limits and FIX.
- [TradingView webhooks: guides to alerts and Pine Script](https://fincodelabs.com/en/blog/tradingview-webhooks): What a TradingView webhook is, which plans include it, its delivery limits, alert message format, why alerts fail, Pine Script and what the terms of use say.
- [Fintech software development guides: data, brokers, cost](https://fincodelabs.com/en/blog/fintech-software): Guides for teams building finance software: market data licenses, broker APIs and FIX, order management, portfolio tracking, Turkish payment rails and app cost.
- [All guides](https://fincodelabs.com/en/blog/): Every guide on trading software and on money and investing in Turkey, with search.

---

Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/blog/crypto-exchange-apis