# Binance API key: how to create one, plus 7 other exchanges

URL: https://fincodelabs.com/en/blog/exchange-api-key-how-to · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Category: Exchange APIs · Published: 2026-11-05 · Updated: 2026-11-05

How to create a Binance API key, plus Coinbase, Kraken, Bybit, OKX, KuCoin, Bitget and MEXC: dated steps from official pages, permissions, IP rules and errors.

**Short answer:** To create a **Binance API key**, open Account, then API Management, choose Create API, pick a key type and confirm with two-factor authentication. Other exchanges follow a similar pattern on their own API pages (official pages read on 4 November 2026). On any exchange, give the key read and trade permissions only, leave withdrawals off, restrict it to your server's IP address where that is offered, and create one key per program. OKX, KuCoin and Bitget also ask for a passphrase you choose, and it cannot be recovered if lost.

The steps differ more than you might expect: key types, passphrases and the rules for keys with no IP restriction all vary. Each section comes from that exchange's own page, opened on 4 November 2026, with the page's date where one is shown. Menus change, so this guide uses names rather than screenshots. Exchanges are listed for reference only, with no ranking and no referral links; storing and rotating keys is covered in [API key security for trading bots](https://fincodelabs.com/en/blog/api-key-security-trading-bots).

Nothing here recommends a platform or strategy, and automated trading can lose money. Availability depends on your jurisdiction and the platform's terms. In Turkey, Article 99/A of [Capital Markets Law No. 6362](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6362.pdf) treats activity by foreign-based crypto-asset platforms directed at Turkish residents as unauthorized service provision, and the Capital Markets Board (SPK) [has stated](https://spk.gov.tr/duyurular/basin-duyurulari/2024/kripto-varlik-hizmet-saglayicilara-iliskin-duyuru_05082024) that appearing on its list of operating providers does not mean a firm is authorized.

## One rule for every exchange API key

Whatever the exchange, a program's key should be able to read and trade and nothing else, should work only from known addresses, and should belong to that program alone. Fincode's security page shows one company's [API key handling in practice](https://fincodelabs.com/en/security).

**What differs, from official pages read 4 November 2026 (alphabetical, not a ranking)**

| Exchange | Signing | Passphrase | Key without an IP restriction | Test environment |
| --- | --- | --- | --- | --- |
| Binance | Ed25519 (recommended by Binance), RSA, HMAC (deprecated) | No | HMAC key: read only by default | Spot Testnet, separate keys |
| Bitget | HMAC-SHA256 or RSA | Yes | Binding strongly recommended | Demo key, `paptrading: 1` header |
| Bybit | HMAC (system key) or RSA (own key pair) | No | Invalid after 90 days, or 7 days after a password change | Testnet, separate keys |
| Coinbase | ECDSA (ES256) JWT | No | Allowlist recommended, not required | Static sandbox, mocked responses |
| Kraken | HMAC-SHA512 with a nonce | No | Optional restriction | [Futures demo; Spot UAT on request](https://docs.kraken.com/exchange/guides/overview) |
| KuCoin | HMAC-SHA256 | Yes | Trading keys deleted or stripped of trading after 30 days of inactivity | [Order test endpoint](https://www.kucoin.com/docs-new/rest/spot-trading/orders/add-order-test); no test host on the pages read |
| MEXC | HMAC-SHA256 | No | Valid for 90 days, renewable | No sandbox, per [its API page](https://www.mexc.com/mexc-api); [order test endpoint](https://www.mexc.com/api-docs/spot-v3/spot-account-trade/test-new-order) |
| OKX | HMAC-SHA256 | Yes | Trade or withdraw keys expire after 14 days of inactivity | Demo keys, `x-simulated-trading: 1` header |

> **Hypothetical example.** A team runs one trading bot and one reporting job, so it creates two keys: read and trade for the bot, allowlisted to the bot's server, and read-only for the reporting job, allowlisted to its own server. If the reporting server leaks its key, the team deletes that key, the bot keeps running, and the attacker never had order permission.

## Binance API key

A Binance API key is created under Account, API Management. These steps come from Binance's support article, last updated 20 March 2025.

1. Meet the prerequisites: two-factor authentication on, any deposit made to the Spot wallet, and identity verification complete.
2. Log in, click the profile icon, then Account, API Management, Create API.
3. Choose system-generated (HMAC; you receive a key and secret) or self-generated (Ed25519 or RSA; you create the pair and give Binance the public key).
4. Enter a label and confirm with your 2FA devices or passkey.

Binance's API documentation recommends Ed25519 and marks HMAC keys as deprecated. Since 30 January 2023, under its default security controls, a system-generated key with unrestricted IP access can only be set to read. Withdrawal permission requires an IPv4 restriction, and a key cannot trade until you enable trading. Commands for generating an Ed25519 pair are in the [Binance API Python guide](https://fincodelabs.com/en/blog/binance-api-python-trading-bot).

## Coinbase API key

A Coinbase API key for Advanced Trade is created in the Coinbase Developer Platform portal, and the one setting you must change is the signature algorithm. These steps come from Coinbase's API key authentication page.

1. Open the portal's API Keys tab and select Secret API Keys, then Create API key.
2. Enter a nickname and expand API restrictions and Advanced Settings.
3. Enter your IPs in the allowlist and set portfolio and permission restrictions.
4. Change the signature algorithm to ECDSA. Coinbase says Ed25519 is not supported by its Coinbase App APIs.
5. Create the key and store the key name and private key securely.

The key name looks like `organizations/{org_id}/apiKeys/{key_id}`, and requests carry a JWT that expires after 2 minutes. Coinbase warns that someone holding a secret with the transfer permission could send all the digital currency out of the account, so leave that off. Its sandbox needs no key, and all its responses are mocked, so it tests request format and not your key.

## Kraken API key

A Kraken API key is created under Settings, API, where you tick individual permissions. These steps come from Kraken's support article, last updated 29 October 2026.

1. Sign in on Kraken Pro, open the account menu, select Settings, then the API tab, then Create API key.
2. Enter a unique name that reveals nothing sensitive.
3. Choose permissions. Kraken's documentation lists these for algorithmic spot trading: Query Funds, Query Open Orders & Trades, Create & Modify Orders, and Cancel/Close Orders. The support article calls the third one Modify Orders.
4. Review the optional settings: IP address restriction, key expiration and a custom nonce window. Then click Generate key.

Each private request needs an always-increasing nonce, and [Kraken's authentication guide](https://docs.kraken.com/exchange/guides/rest/authentication) says that sharing a key across processes can make requests arrive out of order, and that too many invalid nonces can bring a temporary ban. That is one more reason for one key per program.

## Bybit API key

A Bybit API key can only be created on the website, not in the app. These steps come from Bybit's help article, last updated 25 November 2025.

1. Go to the API management page (`bybit.com/app/user/api-management`, or the same path on `testnet.bybit.com`).
2. Click Create New Key and configure the key in the window that appears.
3. Enter your Google Authenticator code and click Next Step.

Bybit's integration guide says system-generated keys use HMAC, while self-generated keys use RSA, where Bybit receives only your public key. The article warns that new accounts may be restricted from creating keys for the first 48 hours. Bybit's [API FAQ](https://bybit-exchange.github.io/docs/faq) says a key created with no bound IP expires after 90 days, and its [sub-account key page](https://bybit-exchange.github.io/docs/v5/user/create-subuid-apikey) adds that such a key becomes invalid 7 days after the account password changes.

## OKX API key and KuCoin API key: the passphrase

Both OKX and KuCoin require a passphrase you choose at creation, which you must keep because neither can give it back.

### OKX

From OKX's API FAQ, updated 28 September 2026: go to Profile, select API and connections, then Create API key, and fill in the name, account and purpose, IP allowlist, permissions and passphrase. The API documentation lists three permissions, Read, Trade and Withdraw, and says Trade covers funding transfers. The FAQ also describes separate Transfer, Loan and Earn permissions, the last two only where the account is eligible, and says a key that already had Trade receives all three automatically, so check the settings of any older key. Each key can bind up to 20 IP addresses, and a key with no IP and with trade or withdraw permission expires after 14 days of inactivity. The FAQ adds that in certain areas, creating a key requires more than 100 USD in assets.

### KuCoin

From KuCoin's help article, last updated 17 December 2025: log in, click the avatar, select API Management, then Create API. Choose API Trading, enter a name and passphrase, select permissions, add your IP address to the whitelist as the page prompts, and confirm with your trading password, email code and Google code.

KuCoin's authentication page says the key, secret and passphrase cannot be recovered once lost, and that every request states the key version shown on the API Management page. Keys enabled for trading with no IP may be deleted or lose trade permission after 30 days of inactivity; General-only keys do not expire. Older keys can hit [error 400008](https://www.kucoin.com/docs-new/338715m0), which means V1 and V2 keys are no longer supported by that API and you must create a V3 key.

## Bitget API key and MEXC API key

Bitget adds a passphrase and supports demo keys; MEXC needs no passphrase but puts a 90-day life on any key with no IP whitelist.

### Bitget

From the Quick Start page of Bitget's Unified Trading Account documentation: log in on the website, open API Key Management to create the key, then configure read-only or read and write permissions. The passphrase cannot be changed or retrieved, so if it is lost the key must be recreated. Binding an IP is strongly recommended. The page allows up to 50 key sets per UID, while Bitget's [classic documentation](https://www.bitget.com/docs/classic/rest-api) says 10 and adds that withdrawals work only from whitelisted IPs, so check your own account's screen. For demo trading, switch the account to Demo mode and create a Demo API key there.

### MEXC

From MEXC's Spot API introduction: create the key on the API management page (`mexc.com/user/openapi`) and tick the required permissions. A key with no IP whitelist is valid for 90 days, and from 5 days before expiry you can renew it for another 90 under My API Key, Action, Renew. That page also lets you set which trading pairs the key may trade. If a key leaks, MEXC says to delete it at once and create another.

## Check the key before you run anything

Before a program trades, confirm what its key can do and be ready for the errors a new key usually returns.

**Errors a new key often returns, from each exchange's documentation read 4 November 2026**

| Exchange | Code or message | Usual meaning |
| --- | --- | --- |
| Binance | `-2015` | Invalid key, IP or permissions; see [Binance API error codes](https://fincodelabs.com/en/blog/binance-api-error-codes) |
| [Bybit](https://bybit-exchange.github.io/docs/v5/error) | `10003`, `10005`, `10010` | Key and domain mismatch; permission denied; IP does not match the binding |
| [Kraken](https://docs.kraken.com/exchange/guides/general/errors) | `EGeneral:Permission denied`, `EAPI:Invalid nonce` | Missing permission; nonce out of order |
| KuCoin | `400003`, `400004`, `400006` | Key does not exist; wrong passphrase; IP not allowed |
| MEXC | HTTP 401 | Authentication or permission error |
| OKX | `50119`, `50105`, `50102` | API key does not exist; passphrase incorrect; timestamp expired (30-second window) |

Some exchanges can also report what a key is allowed to do. This helper refuses to start if a key can move funds. It was tested on 4 November 2026 on synthetic responses shaped like the documented examples (the `result` object on Bybit, `data[0]` on OKX), so no real key was used, and it covers only the four endpoints read for this guide: [Binance](https://developers.binance.com/en/docs/catalog/core-trading-wallet/api/rest-api/account), [Bybit](https://bybit-exchange.github.io/docs/v5/user/apikey-info), [Coinbase](https://docs.cdp.coinbase.com/api-reference/advanced-trade-api/rest-api/data-api/get-api-key-permissions) and OKX.

```python
def can_move_funds(exchange, r):
    """True if a key-permission response allows withdrawals or transfers."""
    if exchange == "binance":      # GET /sapi/v1/account/apiRestrictions
        return any(r[f] for f in ("enableWithdrawals", "enableInternalTransfer",
                                  "permitsUniversalTransfer"))
    if exchange == "bybit":        # GET /v5/user/query-api, pass "result"
        return bool(r["permissions"]["Wallet"])
    if exchange == "coinbase":     # GET /api/v3/brokerage/key_permissions
        return bool(r["can_transfer"])
    if exchange == "okx":          # GET /api/v5/account/config, pass data[0]
        return "withdraw" in r["perm"].split(",")
    raise ValueError(f"no check written for {exchange}")

# Synthetic responses, shaped like the documented examples
samples = [("binance", {"enableWithdrawals": False, "enableInternalTransfer": False,
                        "permitsUniversalTransfer": False, "ipRestrict": True}),
           ("bybit", {"permissions": {"Spot": ["SpotTrade"], "Wallet": ["AccountTransfer"]}}),
           ("coinbase", {"can_view": True, "can_trade": True, "can_transfer": False}),
           ("okx", {"perm": "read_only,withdraw,trade"})]
for exchange, response in samples:
    print(exchange, "refuse to start" if can_move_funds(exchange, response) else "ok")
```

Output:

```
binance ok
bybit refuse to start
coinbase ok
okx refuse to start
```

A missing field raises an error instead of passing, so an error body cannot read as ok. A passing check still does not settle everything: OKX documents only `read_only`, `trade` and `withdraw` as `perm` values, so this check cannot see the Transfer permission its FAQ describes. Read each exchange's definition and the key's settings screen. Signing, limits and reconnects come next, in [crypto exchange API integration](https://fincodelabs.com/en/blog/crypto-exchange-api-integration). If you plan to commission that work, the [exchange API integration](https://fincodelabs.com/en/services/exchange-api-integration) page describes it in general terms; which platforms a project may use depends on the customer's jurisdiction and the platform's terms.

## Frequently asked questions

### What permissions should a trading bot API key have?

Read and trade only. A bot never needs withdrawal or transfer rights, and reporting tools need only read access. Check each exchange's definition: OKX's documentation says Trade covers funding transfers, and its FAQ describes a separate Transfer permission that existing Trade keys received automatically.

### Can I recover a lost API passphrase or secret?

Not on OKX, KuCoin or Bitget, whose documentation says a lost passphrase means creating a new key.

### Why did my API key stop working after some days?

Check for an IP restriction. As documented on 4 November 2026, keys without one expire after 90 days on Bybit and MEXC, and trading keys without one can be removed or restricted after 14 days of inactivity on OKX and 30 on KuCoin.

### Does a testnet key work on the live exchange?

No. Test environments on Binance and Bybit, for example, use separate keys, and Bybit reports a mismatch as error 10003. Coinbase's sandbox uses no key at all.

## Sources

- [Binance Support: How to Create API Keys on Binance (updated 20 March 2025)](https://www.binance.com/en/support/faq/detail/360002502072)
- [Binance Spot API documentation: API key types](https://github.com/binance/binance-spot-api-docs/blob/master/faqs/api_key_types.md)
- [Coinbase: Coinbase App API key authentication](https://docs.cdp.coinbase.com/coinbase-app/authentication-authorization/api-key-authentication)
- [Coinbase: Advanced Trade sandbox](https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/sandbox)
- [Kraken Support: How to create an API key (updated 29 October 2026)](https://support.kraken.com/articles/how-to-create-an-api-key-on-kraken-pro)
- [Kraken: API key permissions](https://docs.kraken.com/exchange/guides/rest/api-keys)
- [Bybit Help Center: How to Create Your API Key (updated 25 November 2025)](https://www.bybit.com/en/help-center/article/How-to-create-your-API-key)
- [Bybit API v5: Integration guide (key types, hosts)](https://bybit-exchange.github.io/docs/v5/guide)
- [Bybit API: FAQ (expiry of keys with no bound IP)](https://bybit-exchange.github.io/docs/faq)
- [OKX API v5 documentation (key creation, permissions, demo trading, error codes)](https://www.okx.com/docs-v5/en/)
- [OKX: API FAQ (updated 28 September 2026)](https://www.okx.com/help/api-faq)
- [KuCoin Help Center: How to Create API (updated 17 December 2025)](https://www.kucoin.com/support/360015102174)
- [KuCoin API: Authentication (modified 23 August 2026)](https://www.kucoin.com/docs-new/authentication)
- [Bitget API: Unified Trading Account quick start](https://www.bitget.com/docs/uta/quick-start)
- [MEXC Spot API: Introduction](https://www.mexc.com/api-docs/spot-v3/introduction)

> This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the [editorial policy](https://fincodelabs.com/en/editorial-policy).

---

Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/blog/exchange-api-key-how-to

Cite as: Fincode, "Binance API key: how to create one, plus 7 other exchanges", updated November 5, 2026, https://fincodelabs.com/en/blog/exchange-api-key-how-to