Short answer: On the official pages read on 5 November 2026, nine of these 13 platforms document HMAC-SHA256 signing, Gate and Kraken use HMAC-SHA512, Coinbase Advanced Trade uses ES256 JWTs and Hyperliquid uses wallet signatures. Binance, Bybit, Deribit and Kraken document FIX. No test environment was found for BtcTurk, KuCoin, MEXC or Paribu, and Coinbase's sandbox returns fixed responses.
Every cell comes from a platform's own pages or, where the cell says live, its public API response, read on the date in the table's caption. Rows are alphabetical, and the order means nothing. Where a fact is missing, the cell says "not found on official pages, 5 November 2026". That means the pages we opened did not show it, not that it does not exist. Limits change without notice, so read the linked page before you rely on a number. Announced changes are in the exchange API change log. If a cell is wrong or out of date, send the official link through the contact form.
Being listed here is not a recommendation, and Fincode has no affiliation with any platform on this page. There are no referral links, and a row here does not mean Fincode has built on that platform. Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized. Availability depends on your country and each platform's terms.
Authentication and signed string
Most platforms sign a string built from a timestamp and the request. They differ in what goes into the string, the hash, the output encoding and how far your clock may drift.
| Platform | Scheme and headers | Signed string and clock rule |
|---|---|---|
| Binance | HMAC-SHA256, RSA (PKCS#8) or Ed25519. Key in X-MBX-APIKEY, signature as the signature parameter. The docs recommend Ed25519. | query string + body, percent-encoded, no separator. HMAC output is hex; RSA and Ed25519 output is base64. timestamp in milliseconds or microseconds; rejected if more than 1 second ahead of server time or older than recvWindow (default 5,000 ms, maximum 60,000 ms). |
| Bitget | HMAC-SHA256 or RSA, base64 output. Headers ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP, ACCESS-PASSPHRASE. | timestamp + METHOD + requestPath + ? + queryString + body; leave out ? + queryString when the query is empty. Timestamp in milliseconds, within 30 seconds of server time. |
| BtcTurk | HMAC-SHA256 keyed with the base64-decoded secret, base64 output. Headers X-PCK, X-Stamp, X-Signature. | public key + nonce, where the nonce is the time in milliseconds. Path and body are not signed. The FAQ gives a tolerance of 5 seconds. WebSocket login samples sign the public key plus a fixed nonce of 3000 and send the time separately. |
| Bybit | HMAC-SHA256 with system-generated keys, RSA-SHA256 with self-generated keys. Headers X-BAPI-API-KEY, X-BAPI-TIMESTAMP, X-BAPI-SIGN, optional X-BAPI-RECV-WINDOW. | GET: timestamp + API key + recv_window + queryString. POST: timestamp + API key + recv_window + jsonBodyString. Lowercase hex for HMAC, base64 for RSA. Valid when server_time - recv_window <= timestamp < server_time + 1000; default window 5,000 ms. |
| Coinbase Advanced Trade | One CDP API key. A JWT signed with ES256 (ECDSA P-256), sent as Authorization: Bearer. The docs say Coinbase App SDKs do not support Ed25519 keys. | JWT claims sub, iss (cdp), nbf, exp and uri (METHOD host path); JWT header kid and nonce. A new JWT for each request; each expires after 2 minutes. The Global Derivatives gateway exchanges a JWT for an access token at public/auth. |
| Deribit | public/auth with client_credentials, client_signature or refresh_token, then a token: a Bearer header over HTTP, an access_token parameter over WebSocket. HTTP can also use Authorization: deri-hmac-sha256. HMAC-SHA256, hex output; asymmetric Ed25519 and RSA keys are also documented. | WebSocket: Timestamp \n Nonce \n Data. HTTP: Timestamp \n Nonce \n METHOD \n URI \n Body \n. Timestamp in milliseconds, valid for 60 seconds. |
| Gate | HMAC-SHA512, hex output. Headers KEY, Timestamp, SIGN. | METHOD \n path \n query \n SHA512(body) \n timestamp, with the body hash in hex. Timestamp in seconds, within 60 seconds of current time. WebSocket: channel=...&. |
| Hyperliquid | No API key and secret. Actions are signed by a wallet private key; an approved API (agent) wallet can sign for a master account or sub-account. The docs recommend an SDK over manual signing. | Two schemes: L1 actions and user-signed actions (sign_l1_action, sign_ in the Python SDK). Field order matters for msgpack. Nonces must fall between 2 days before and 1 day after the block time. |
| Kraken | Spot: API-Key, API-Sign, HMAC-SHA512 with the base64-decoded secret, base64 output. Derivatives: APIKey, Authent, optional Nonce. | Spot: URI path + SHA256(nonce + POST data); the nonce always increases. Derivatives: SHA-256(postData + nonce + endpointPath), then HMAC-SHA-512. Spot WebSocket uses a token from GetWebSocketsToken, valid for 15 minutes. |
| KuCoin | HMAC-SHA256, base64 output. Headers KC-API-KEY, KC-API-SIGN, KC-API-TIMESTAMP, KC-API-PASSPHRASE, KC-API-KEY-VERSION. The passphrase is also HMAC-signed. | timestamp + method + endpoint + body, using the URL before encoding. Timestamp in milliseconds. Allowed clock gap: not found on official pages, 5 November 2026. |
| MEXC | Spot: HMAC-SHA256, lowercase hex, X-MEXC-APIKEY. Futures: ApiKey, Request-Time, Signature. | Spot: queryString + requestBody, with nothing between them; recvWindow default 5,000 ms, maximum 60 seconds. Futures: accessKey + timestamp + parameterString; 10 seconds by default, Recv-Window up to 60. |
| OKX | HMAC-SHA256, base64 output. Headers OK-ACCESS-KEY, OK-ACCESS-SIGN, OK-ACCESS-TIMESTAMP, OK-ACCESS-PASSPHRASE. | timestamp + METHOD + requestPath + body; GET parameters count as part of the path. ISO 8601 UTC timestamp, within 30 seconds of server time (error 50102). |
| Paribu | HMAC-SHA256, base64 output. Raw key in Authorization, signature in X-Signature. X-Timestamp is optional now; the docs say a future version will require it. | timestamp + queryString + body, no separators. The path is not signed. When sent, the timestamp must be within 5 seconds of server time. |
Exchange API rate limits: how each platform counts
Exchange API rate limits are not one number. Some platforms count weight per IP, some use a counter per key or credits per sub-account, and order limits often sit apart from request limits. Numbers below are the ones published, and many vary by endpoint, tier or account.
| Platform | What is counted and published numbers | Over the limit |
|---|---|---|
| Binance | Weight per IP, not per key, and unfilled orders per account. Live exchangeInfo: Spot 6,000 weight per minute, 100 orders per 10 seconds, 200,000 per day; USD-M 2,400 weight per minute, 300 orders per 10 seconds, 1,200 per minute. Headers X-MBX-USED-WEIGHT-*, X-MBX-ORDER-COUNT-*. | HTTP 429 with Retry-After. Continuing brings HTTP 418, an IP ban from 2 minutes to 3 days. HTTP 403 is a firewall block. |
| Bitget | Per UID or IP, per endpoint, with each limit on the endpoint's page. Overall 6,000 requests per IP per minute on the common domain. REST and WebSocket share a quota. Header x-mbx-used-remain-limit. | HTTP 429. |
| BtcTurk | A table per endpoint, each with an account or IP policy. Orders: 300 per 60 seconds and 10 per second (POST and DELETE, account and IP). /api/v2/ticker: 600 per 60 seconds by IP. | HTTP 429 with Retry-After. The table lists a block time per rule, such as 60 seconds. |
| Bybit | 600 requests per 5 seconds per IP by default, plus a limit per UID per endpoint in a rolling one-second window. Headers X-Bapi-Limit, X-Bapi-Limit-Status, X-Bapi-Limit-Reset-Timestamp. | IP: HTTP 403, wait at least 10 minutes. UID: retCode 10006. |
| Coinbase Advanced Trade | REST figures for Advanced Trade: not found on official pages, 5 November 2026. A Coinbase App page gives 10,000 requests per hour per key without saying that it covers Advanced Trade. WebSocket: connections and unauthenticated messages are each limited to 8 per second per IP. The Global Derivatives gateway uses credits. | Coinbase App page: HTTP 429, rate_limit_exceeded. Global Derivatives: running out of credits disconnects you, with no retryable HTTP 429. |
| Deribit | Credits per sub-account. Non-matching calls: 500 credits each, pool 50,000, refill 10,000 per second (20 requests per second, burst 100). Matching engine: tier by 7-day volume, 5 to 30 requests per second, burst 20 to 100. Calls without authentication are limited by IP. Test and production pools are separate. | too_many_requests (10028), and the session is terminated. |
| Gate | Per endpoint. Public: 200 per 10 seconds by IP. Spot: orders 10 per second by UID and market, cancels 200 per second. Perpetuals: orders 100 per second, cancels 200 per second. A fill-ratio rule can lower Spot order limits. Headers X-Gate-RateLimit-Requests-Remain, X-Gate-RateLimit-Limit, X-Gate-RateLimit-Reset-Timestamp. | HTTP 429. |
| Hyperliquid | Per IP: 1,200 weight per minute. Per address: 1 request per 1 USDC traded since the address began, with a starting buffer of 10,000. Open orders: 1,000 by default, up to 5,000 with volume. | An address over its limit gets one request every 10 seconds; cancels have a higher limit. |
| Kraken | Spot REST: a counter per key, maximum 15, 20 or 20, falling 0.33, 0.5 or 1 per second by tier. Spot engine, all protocols: a counter per pair, thresholds 60, 125 or 180, plus 60, 80 or 225 open orders per pair. Derivatives: 500 cost per 10 seconds on /derivatives. | EAPI:Rate limit exceeded, EOrder:Rate limit exceeded, apiLimitExceeded. |
| KuCoin | Pools by VIP level: private by UID, public by IP. Unified Trading Account (UTA) trading: 300 per second at VIP0, up to 4,000 at VIP12. Public: 2,000 per 30 seconds. Classic Spot: 4,000 per 30 seconds at VIP0. Headers gw-ratelimit-limit, gw-ratelimit-remaining, gw-ratelimit-reset. | HTTP 429 with code 429000, and a header says when to resume. Server overload can return the same code without those headers. |
| MEXC | Endpoints with a key count by UID, others by IP, separately. IP: 300 weight per 10 seconds. UID: 500 weight per 10 seconds. Futures limits appear per endpoint, such as 20 requests per 2 seconds. | HTTP 429 with Retry-After. Continuing brings an IP ban from 2 minutes to 3 days. |
| OKX | Per endpoint: public by IP, private by User ID, WebSocket login and subscribe by connection. Trading limits are per instrument and shared by REST and WebSocket. 1,000 new or amended orders per 2 seconds per sub-account. VIP5 and above can get more, based on fill ratio. | Error 50011; sub-account limit error 50061. |
| Paribu | Per user. GET requests draw on 100,000 weight per minute (ticker 1, open orders 5, trade history 20). Standard users: 25 order creates and 25 cancels per second. Header X-Quota-Remaining. | HTTP 429 with Retry-After and a retry_after field. |
WebSocket availability and connection limits
All 13 platforms document WebSocket access. Connection limits, subscription limits and keep-alive rules differ, and a reconnect loop can hit them quickly.
| Platform | Availability and endpoints | Published limits and keep-alive |
|---|---|---|
| Binance | Yes. Market streams wss://stream.. WebSocket API with order entry wss://ws-api.. | 300 connections every 5 minutes per IP. Streams: 1,024 per connection, 5 incoming messages per second. A connection lasts 24 hours; server ping every 20 seconds, disconnect without a pong within 1 minute. Connecting to the WebSocket API costs 2 weight. |
| Bitget | Yes. wss://ws., /private, /public/sbe. Orders can be placed over WebSocket. | 300 connection requests per 5 minutes and 100 connections per IP. 240 subscription requests per hour and 1,000 channels per connection; 10 messages per second. Send ping every 30 seconds; disconnect after 2 minutes without one. |
| BtcTurk | Yes. wss://ws-feed-pro., with HMAC login. | 15 connection requests per minute, then new connections are blocked for 60 seconds. Subscriptions do not count. Keep-alive rule: not found on official pages, 5 November 2026. |
| Bybit | Yes. wss://stream. and other markets, /v5/private, order entry /v5/trade. | 500 connections in 5 minutes per domain; 1,000 connections per IP for market data, counted per market. Spot: 10 args per request. Options: 2,000 args per connection. The Connect page also lists 100 args per connection for Spot and Futures, with the date marked TBD. The docs recommend ping every 20 seconds. |
| Coinbase Advanced Trade | Yes. Market data wss://advanced-trade-ws., user data wss://advanced-trade-ws-user.. Global Derivatives wss://drb., wss://streams.. | Connections and unauthenticated messages: 8 each per second per IP (a second official page differs; see the conflicts below). Subscribe within 5 seconds of connecting or be disconnected. Most public channels close within 60 to 90 seconds with no updates; the docs say to subscribe to heartbeats. |
| Deribit | Yes, the interface the docs recommend for most uses. JSON-RPC at wss://www.. | 32 connections per IP, and HTTP requests count while they run. 16 sessions per API key; the oldest is removed past that. Heartbeats through public/set_heartbeat, minimum interval 10 seconds. |
| Gate | Yes. Spot wss://api., Simple Binary Encoding (SBE) wss://api.. USDT futures wss://fx-ws.. Order channels such as spot.order_place. | 300 connections per IP. WebSocket orders: Spot 10 per second, futures 100 per second. Protocol-level ping and pong; spot.ping is optional. |
| Hyperliquid | Yes. wss://api., for subscriptions and as an alternative to HTTP requests. | Per IP: 10 connections, 30 new connections per minute, 1,000 subscriptions, 10 unique users, 2,000 messages per minute, 100 inflight posts. The server closes a connection it has sent nothing to for 60 seconds; send a ping. |
| Kraken | Yes. Spot wss://ws.kraken.com/v2, authenticated wss://ws-auth., with order entry. Derivatives wss://futures., market and account data, no order entry. | Spot: about 150 connection attempts per rolling 10 minutes per IP, then a 10-minute ban; closed after about 1 minute idle. Derivatives: 100 connections, 100 requests per second; ping at least every 60 seconds. |
| KuCoin | Yes. UTA wss://x-push-spot., wss://x-push-futures., wss://wsapi-push., order entry wss://wsapi.kucoin.com. Classic wss://ws-api-spot., wss://ws-api-futures.. | UTA per IP: public Spot 500, public Futures 800, private 1,024 connections; 300 new connections per 5 minutes (public Futures 250). Per connection: 300 messages per 10 seconds public, 100 private; 600 or 400 topics. Classic: 800 connections, 100 messages per 10 seconds, 400 Spot topics. Ping at the pingInterval the server sends. |
| MEXC | Yes. Spot wss://wbs-api., with protobuf channels. Futures wss://contract., JSON or protobuf. | Spot: 30 subscriptions per connection, 100 requests per second, 24-hour connection life; dropped after 30 seconds with no valid subscription or 1 minute with no traffic. Futures connection limits: not found on official pages, 5 November 2026. |
| OKX | Yes. wss://ws., /private, /business, with order placing, amending and canceling. | 3 connection requests per second per IP. 480 subscribe, unsubscribe and login requests per hour per connection. 30 connections per listed private channel per sub-account. Closed after 30 seconds without a subscription or data; send ping. Use port 443. |
| Paribu | Yes. wss://api., public data. Beta: wss://api., /v1/wapi/user; the docs warn that format and channel names may change. | Beta, anonymous or standard user: 8 per IP or 32 per user open; 128 or 256 channels per connection; 24 per IP or 96 per user connection attempts per 5 minutes. Server ping every 20 seconds, closed without a pong within 30 seconds. Older streams: up to 100 connections per client. |
Test environments and their caveats
A test environment is not always a copy of production. Some use the production host with a header, some return fixed responses, and some reset without notice. Tests show how software behaves, not future results.
| Platform | Test environment | Caveats on the official pages |
|---|---|---|
| Binance | Spot Testnet testnet.binance.vision. Spot Demo Mode demo-api.binance.com. USD-M demo-fapi.binance.com. | Testnet: virtual funds, no /sapi; reset to blank about once a month with no prior notice (orders go, keys stay); prices independent of live; sometimes has features before live. Demo Mode: prices similar to live, limits stated as exactly the same as live, no orders during maintenance. Testnet limits differ from live; see the conflicts below. |
| Bitget | Demo trading: a Demo API key, header paptrading: 1 on api.bitget.com, WebSocket wss://wspap., /private. | Virtual funds. The demo REST page says KYC is needed. A separate test REST host: not found on official pages, 5 November 2026. |
| BtcTurk | not found on official pages, 5 November 2026 | Code samples name ws-feed-sandbox. and api-dev.. No page describes them, and we did not test them. |
| Bybit | Testnet api-testnet.bybit.com, stream-testnet.. Mainnet demo api-demo.bybit.com, wss://stream-demo.. | Demo: its own user ID, not every API, orders kept for 7 days, default rate limit only; the demo stream is private only, with no WebSocket trade. The docs say not to create a key from testnet demo trading. |
| Coinbase Advanced Trade | Sandbox api-sandbox., no authentication. | Static, predefined responses in the production format, for accounts and orders endpoints only. It can check parsing, not order logic. A test environment for Global Derivatives: not found on official pages, 5 November 2026. |
| Deribit | test., wss://test., FIX fix-test.deribit.com. | Separate account and API keys. Rate-limit pools are tracked separately from production. |
| Gate | TestNet api-testnet., wss://ws-testnet., USDT futures wss://ws-testnet.. | Separate from real trading. Real-trading keys do not work on TestNet. |
| Hyperliquid | api., wss://api.. | The faucet gives 1,000 mock USDC and requires a mainnet deposit from the same address. |
| Kraken | Derivatives: self-service demo-futures.. Spot: UAT (a test environment) on request through an account manager. FIX UAT fix.uat.kraken.com. | Spot Beta WebSocket hosts use the production trading engine, so they are not a test environment. |
| KuCoin | not found on official pages, 5 November 2026 | Order test endpoints such as POST /api/v1/hf/orders/test check a request, and the order does not enter matching. |
| MEXC | not found on official pages, 5 November 2026 | No test host, sandbox or testnet appears on the pages read. POST /api/v3/order/test checks a Spot order request without sending it to the matching engine. |
| OKX | Demo trading: openapi.okx.com with a demo key and header x-simulated-trading: 1. WebSocket wss://wspap., /private, /business. | Some functions are not supported, including withdrawal, deposit and purchase or redemption. Demo keys do not expire. |
| Paribu | not found on official pages, 5 November 2026 | No test host, sandbox or testnet appears on the pages read. |
FIX availability
Four of the 13 document FIX access, each on different terms. Bybit says its FIX API covers Spot only, and Binance documents FIX under Spot.
| Platform | FIX status | Details |
|---|---|---|
| Binance | Yes, for Spot. USD-M FIX: not found on official pages, 5 November 2026. | fix-oe.binance.com, fix-dc.binance.com, fix-md.binance.com, port 9000 (9001 and 9002 for SBE), TLS. Ed25519 keys only; logon signs tags 35, 49, 56, 34 and 52. Order Entry: 15 connection attempts per 30 seconds, 10 connections, 10,000 messages per 10 seconds. Testnet hosts such as fix-oe.. |
| Bitget | not found on official pages, 5 November 2026 | No mention on the pages read. |
| BtcTurk | not found on official pages, 5 November 2026 | No mention on the pages read. |
| Bybit | Yes, Spot only, by whitelist. | FIX 4.4 over TLS. fix-oe.bybit.com:9000, testnet fix-oe-testnet.. Self-generated RSA keys only; logon signs GET/realtime + expires with RSA-SHA256. Whitelisting is by UID or institution. Resend and gap fill are not supported. |
| Coinbase Advanced Trade | Not on Advanced Trade. | The Advanced Trade FAQ says FIX is not supported there. Coinbase Exchange, a separate product for institutional clients, documents FIX 5.0 SP2 (opens in a new tab). |
| Deribit | Yes. | A subset of FIX 4.4 with some FIX 5.0 and custom tags. fix.deribit.com, port 9881 (raw TCP) or 9883 (SSL); test fix-test.deribit.com. The client ID is the username, and the password is derived from the client secret. Starbase Drop Copy is for selected clients on private connectivity. |
| Gate | not found on official pages, 5 November 2026 | No mention on the pages read. |
| Hyperliquid | not found on official pages, 5 November 2026 | No mention on the pages read. |
| Kraken | Yes, through an account manager. | FIX 4.4 for Spot and Derivatives. fix.kraken.com, UAT fix.uat.kraken.com, ports 4000 to 4005, TLS 1.3, IP whitelisting. Trading sessions sign with HMAC-SHA512. |
| KuCoin | not found on official pages, 5 November 2026 | No mention on the pages read. |
| MEXC | not found on official pages, 5 November 2026 | No mention on the pages read. |
| OKX | not found on official pages, 5 November 2026 | The V5 docs do not mention FIX. A support notice dated 8 December 2017 (opens in a new tab) says the service was suspended from 9 December 2017 for an upgrade. |
| Paribu | not found on official pages, 5 November 2026 | No mention on the pages read. |
Crypto exchange API documentation and changelog links
These are the main official pages behind the tables above, with the date of the newest changelog entry we saw.
Our own Python guides, based on the same kind of official pages, cover Binance, Bybit, Coinbase Advanced Trade, Hyperliquid, Kraken and OKX. They were read on their own dates, so where a guide and this page differ, go by the official page.
Where official pages disagree
These are conflicts we saw between official pages, or within one page. Test the behavior yourself before you rely on either version. We noticed none for Hyperliquid or Kraken on the pages read.
| Platform | What the official pages say |
|---|---|
| Binance | The Testnet page says limits are generally the same as on the Spot API. Live exchangeInfo on 5 November 2026 showed Spot 100 orders per 10 seconds and 200,000 per day, against 50 and 160,000 on Spot Testnet. USD-M showed 2,400 weight per minute, against 6,000 on its demo host. |
| Bitget | The REST API page allows 10 API keys per UID; Quick Start allows 50. The REST API page lists /v2/ws hosts; Quick Start lists /v3/ws. Quick Start asks for a login timestamp in milliseconds, while its sample divides by 1,000 and shows a value in seconds. |
| BtcTurk | The FAQ says private endpoint limits are per account. The rate limit table marks private endpoints such as /api/v1/users/balances as per IP. Recent Changes (20 June 2022) raises /api/v1/openOrders to 330; the table shows 300. |
| Bybit | The rate limit page names api.bybick.com; the integration guide names api.bytick.com. The guide's signing steps say to add the signature to X-BAPI-API-KEY; its header list and examples use X-BAPI-SIGN. The limit of 100 args per connection is on the Connect page but not in the changelog, and its date read 26 November 2026 in our first read on 5 November 2026 and TBD in later reads that day. |
| Coinbase Advanced Trade | The Coinbase App WebSocket limit page gives 8 connections per second per IP; the Coinbase Business copy (opens in a new tab) gives 750. The sandbox page still lists /intx/* paths, which the REST page and changelog say were retired on 1 October 2026. The older REST rate limit address now redirects to the overview, which gives no figure. The WebSocket overview's JavaScript sample sets the JWT issuer to cdp; its Python sample sets coinbase-cloud. |
| Deribit | The rate limit page's upgrade example jumps from Tier 1 to Tier 4, while its table makes Tier 1 the highest-volume tier. |
| Gate | The authentication section says both 20 API keys per account and at most 5 keys per user. |
| KuCoin | The introduction says weight updates every 30 seconds; the rate limit pages say every 1 second, and the Classic page describes a 1-second window beside quotas per 30 seconds. The UTA page's example gives VIP5 700 per second; its table gives 900. The change log page shows a modified date of 3 November 2026 above an entry dated 6 November 2026. The WebSocket error list (opens in a new tab) names 50 sessions and 300 subscriptions per session, which differs from the limit pages. |
| MEXC | The FAQ says access returns after 10 minutes. The limits section describes bans from 2 minutes to 3 days, with Retry-After. |
| OKX | The change log says port 8443 stops on the public internet from 31 October 2026. On 5 November 2026 the general section still said it would be retired soon. |
| Paribu | The scopes page says scopes cannot be customized at key creation; the key page offers a Custom option. The signing page says not to add an /api prefix; the rate limit table lists paths with /api. |
What this page does not cover
Fees, products, legal status and account requirements are not compared here. A documented endpoint does not prove that a product is available to you, and it does not show that the platform's terms allow your use. OKX's overview, for example, treats continued use of its API as acceptance of its API Agreement (opens in a new tab), and that agreement limits third-party and commercial use without OKX's written approval. Read each platform's terms as well.
Some global brands also run separate regional services with their own hosts and terms, and this page describes the global documents. BtcTurk and Paribu appear on the provisional list of Türkiye's Capital Markets Board (SPK) (opens in a new tab), read on 5 November 2026; SPK says being listed does not mean a firm is authorized. The guide to Turkish crypto exchange APIs covers platforms on that list. Many of the platforms above also offer derivatives, whose availability varies by country and whose leverage can increase losses.