# Crypto exchange API comparison

URL: https://fincodelabs.com/en/exchange-api-comparison · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Updated: 2026-11-06

How 13 crypto platforms document authentication, rate limits, WebSocket connections, test environments and FIX, taken only from their official pages. One dated table per topic, with no ranking.

Last checked: 5 November 2026. Updated by hand when we check.

**Short answer:** On the official pages read on 5 November 2026, nine of these 13 platforms document HMAC-SHA256 signing, Gate and Kraken use HMAC-SHA512, Coinbase Advanced Trade uses ES256 JWTs and Hyperliquid uses wallet signatures. Binance, Bybit, Deribit and Kraken document FIX. No test environment was found for BtcTurk, KuCoin, MEXC or Paribu, and Coinbase's sandbox returns fixed responses.

Every cell comes from a platform's own pages or, where the cell says live, its public API response, read on the date in the table's caption. Rows are alphabetical, and the order means nothing. Where a fact is missing, the cell says "not found on official pages, 5 November 2026". That means the pages we opened did not show it, not that it does not exist. Limits change without notice, so read the linked page before you rely on a number. Announced changes are in the [exchange API change log](https://fincodelabs.com/en/exchange-api-changes). If a cell is wrong or out of date, send the official link through the [contact form](https://fincodelabs.com/en/contact#teklif).

> Being listed here is not a recommendation, and Fincode has no affiliation with any platform on this page. There are no referral links, and a row here does not mean Fincode has built on that platform. Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized. Availability depends on your country and each platform's terms.

## Authentication and signed string

Most platforms sign a string built from a timestamp and the request. They differ in what goes into the string, the hash, the output encoding and how far your clock may drift.

**Authentication scheme and signed string, as read on official pages on 5 November 2026**

| Platform | Scheme and headers | Signed string and clock rule |
| --- | --- | --- |
| Binance | HMAC-SHA256, RSA (PKCS#8) or Ed25519. Key in `X-MBX-APIKEY`, signature as the `signature` parameter. The docs recommend Ed25519. | `query string + body`, percent-encoded, no separator. HMAC output is hex; RSA and Ed25519 output is base64. `timestamp` in milliseconds or microseconds; rejected if more than 1 second ahead of server time or older than `recvWindow` (default 5,000 ms, maximum 60,000 ms). |
| Bitget | HMAC-SHA256 or RSA, base64 output. Headers `ACCESS-KEY`, `ACCESS-SIGN`, `ACCESS-TIMESTAMP`, `ACCESS-PASSPHRASE`. | `timestamp + METHOD + requestPath + ? + queryString + body`; leave out `? + queryString` when the query is empty. Timestamp in milliseconds, within 30 seconds of server time. |
| BtcTurk | HMAC-SHA256 keyed with the base64-decoded secret, base64 output. Headers `X-PCK`, `X-Stamp`, `X-Signature`. | `public key + nonce`, where the nonce is the time in milliseconds. Path and body are not signed. The FAQ gives a tolerance of 5 seconds. WebSocket login samples sign the public key plus a fixed nonce of 3000 and send the time separately. |
| Bybit | HMAC-SHA256 with system-generated keys, RSA-SHA256 with self-generated keys. Headers `X-BAPI-API-KEY`, `X-BAPI-TIMESTAMP`, `X-BAPI-SIGN`, optional `X-BAPI-RECV-WINDOW`. | GET: `timestamp + API key + recv_window + queryString`. POST: `timestamp + API key + recv_window + jsonBodyString`. Lowercase hex for HMAC, base64 for RSA. Valid when `server_time - recv_window <= timestamp < server_time + 1000`; default window 5,000 ms. |
| Coinbase Advanced Trade | One CDP API key. A JWT signed with ES256 (ECDSA P-256), sent as `Authorization: Bearer`. The docs say Coinbase App SDKs do not support Ed25519 keys. | JWT claims `sub`, `iss` (`cdp`), `nbf`, `exp` and `uri` (`METHOD host path`); JWT header `kid` and `nonce`. A new JWT for each request; each expires after 2 minutes. The Global Derivatives gateway exchanges a JWT for an access token at `public/auth`. |
| Deribit | `public/auth` with `client_credentials`, `client_signature` or `refresh_token`, then a token: a Bearer header over HTTP, an `access_token` parameter over WebSocket. HTTP can also use `Authorization: deri-hmac-sha256`. HMAC-SHA256, hex output; asymmetric Ed25519 and RSA keys are also documented. | WebSocket: `Timestamp \n Nonce \n Data`. HTTP: `Timestamp \n Nonce \n METHOD \n URI \n Body \n`. Timestamp in milliseconds, valid for 60 seconds. |
| Gate | HMAC-SHA512, hex output. Headers `KEY`, `Timestamp`, `SIGN`. | `METHOD \n path \n query \n SHA512(body) \n timestamp`, with the body hash in hex. Timestamp in seconds, within 60 seconds of current time. WebSocket: `channel=...&event=...&time=...`. |
| Hyperliquid | No API key and secret. Actions are signed by a wallet private key; an approved API (agent) wallet can sign for a master account or sub-account. The docs recommend an SDK over manual signing. | Two schemes: L1 actions and user-signed actions (`sign_l1_action`, `sign_user_signed_action` in the Python SDK). Field order matters for msgpack. Nonces must fall between 2 days before and 1 day after the block time. |
| Kraken | Spot: `API-Key`, `API-Sign`, HMAC-SHA512 with the base64-decoded secret, base64 output. Derivatives: `APIKey`, `Authent`, optional `Nonce`. | Spot: `URI path + SHA256(nonce + POST data)`; the nonce always increases. Derivatives: `SHA-256(postData + nonce + endpointPath)`, then HMAC-SHA-512. Spot WebSocket uses a token from `GetWebSocketsToken`, valid for 15 minutes. |
| KuCoin | HMAC-SHA256, base64 output. Headers `KC-API-KEY`, `KC-API-SIGN`, `KC-API-TIMESTAMP`, `KC-API-PASSPHRASE`, `KC-API-KEY-VERSION`. The passphrase is also HMAC-signed. | `timestamp + method + endpoint + body`, using the URL before encoding. Timestamp in milliseconds. Allowed clock gap: not found on official pages, 5 November 2026. |
| MEXC | Spot: HMAC-SHA256, lowercase hex, `X-MEXC-APIKEY`. Futures: `ApiKey`, `Request-Time`, `Signature`. | Spot: `queryString + requestBody`, with nothing between them; `recvWindow` default 5,000 ms, maximum 60 seconds. Futures: `accessKey + timestamp + parameterString`; 10 seconds by default, `Recv-Window` up to 60. |
| OKX | HMAC-SHA256, base64 output. Headers `OK-ACCESS-KEY`, `OK-ACCESS-SIGN`, `OK-ACCESS-TIMESTAMP`, `OK-ACCESS-PASSPHRASE`. | `timestamp + METHOD + requestPath + body`; GET parameters count as part of the path. ISO 8601 UTC timestamp, within 30 seconds of server time (error 50102). |
| Paribu | HMAC-SHA256, base64 output. Raw key in `Authorization`, signature in `X-Signature`. `X-Timestamp` is optional now; the docs say a future version will require it. | `timestamp + queryString + body`, no separators. The path is not signed. When sent, the timestamp must be within 5 seconds of server time. |

## Exchange API rate limits: how each platform counts

Exchange API rate limits are not one number. Some platforms count weight per IP, some use a counter per key or credits per sub-account, and order limits often sit apart from request limits. Numbers below are the ones published, and many vary by endpoint, tier or account.

**Rate limit model and published numbers, as read on official pages on 5 November 2026**

| Platform | What is counted and published numbers | Over the limit |
| --- | --- | --- |
| Binance | Weight per IP, not per key, and unfilled orders per account. Live `exchangeInfo`: Spot 6,000 weight per minute, 100 orders per 10 seconds, 200,000 per day; USD-M 2,400 weight per minute, 300 orders per 10 seconds, 1,200 per minute. Headers `X-MBX-USED-WEIGHT-*`, `X-MBX-ORDER-COUNT-*`. | HTTP 429 with `Retry-After`. Continuing brings HTTP 418, an IP ban from 2 minutes to 3 days. HTTP 403 is a firewall block. |
| Bitget | Per UID or IP, per endpoint, with each limit on the endpoint's page. Overall 6,000 requests per IP per minute on the common domain. REST and WebSocket share a quota. Header `x-mbx-used-remain-limit`. | HTTP 429. |
| BtcTurk | A table per endpoint, each with an account or IP policy. Orders: 300 per 60 seconds and 10 per second (POST and DELETE, account and IP). `/api/v2/ticker`: 600 per 60 seconds by IP. | HTTP 429 with `Retry-After`. The table lists a block time per rule, such as 60 seconds. |
| Bybit | 600 requests per 5 seconds per IP by default, plus a limit per UID per endpoint in a rolling one-second window. Headers `X-Bapi-Limit`, `X-Bapi-Limit-Status`, `X-Bapi-Limit-Reset-Timestamp`. | IP: HTTP 403, wait at least 10 minutes. UID: `retCode` 10006. |
| Coinbase Advanced Trade | REST figures for Advanced Trade: not found on official pages, 5 November 2026. A Coinbase App page gives 10,000 requests per hour per key without saying that it covers Advanced Trade. WebSocket: connections and unauthenticated messages are each limited to 8 per second per IP. The Global Derivatives gateway uses credits. | Coinbase App page: HTTP 429, `rate_limit_exceeded`. Global Derivatives: running out of credits disconnects you, with no retryable HTTP 429. |
| Deribit | Credits per sub-account. Non-matching calls: 500 credits each, pool 50,000, refill 10,000 per second (20 requests per second, burst 100). Matching engine: tier by 7-day volume, 5 to 30 requests per second, burst 20 to 100. Calls without authentication are limited by IP. Test and production pools are separate. | `too_many_requests` (10028), and the session is terminated. |
| Gate | Per endpoint. Public: 200 per 10 seconds by IP. Spot: orders 10 per second by UID and market, cancels 200 per second. Perpetuals: orders 100 per second, cancels 200 per second. A fill-ratio rule can lower Spot order limits. Headers `X-Gate-RateLimit-Requests-Remain`, `X-Gate-RateLimit-Limit`, `X-Gate-RateLimit-Reset-Timestamp`. | HTTP 429. |
| Hyperliquid | Per IP: 1,200 weight per minute. Per address: 1 request per 1 USDC traded since the address began, with a starting buffer of 10,000. Open orders: 1,000 by default, up to 5,000 with volume. | An address over its limit gets one request every 10 seconds; cancels have a higher limit. |
| Kraken | Spot REST: a counter per key, maximum 15, 20 or 20, falling 0.33, 0.5 or 1 per second by tier. Spot engine, all protocols: a counter per pair, thresholds 60, 125 or 180, plus 60, 80 or 225 open orders per pair. Derivatives: 500 cost per 10 seconds on `/derivatives`. | `EAPI:Rate limit exceeded`, `EOrder:Rate limit exceeded`, `apiLimitExceeded`. |
| KuCoin | Pools by VIP level: private by UID, public by IP. Unified Trading Account (UTA) trading: 300 per second at VIP0, up to 4,000 at VIP12. Public: 2,000 per 30 seconds. Classic Spot: 4,000 per 30 seconds at VIP0. Headers `gw-ratelimit-limit`, `gw-ratelimit-remaining`, `gw-ratelimit-reset`. | HTTP 429 with code 429000, and a header says when to resume. Server overload can return the same code without those headers. |
| MEXC | Endpoints with a key count by UID, others by IP, separately. IP: 300 weight per 10 seconds. UID: 500 weight per 10 seconds. Futures limits appear per endpoint, such as 20 requests per 2 seconds. | HTTP 429 with `Retry-After`. Continuing brings an IP ban from 2 minutes to 3 days. |
| OKX | Per endpoint: public by IP, private by User ID, WebSocket login and subscribe by connection. Trading limits are per instrument and shared by REST and WebSocket. 1,000 new or amended orders per 2 seconds per sub-account. VIP5 and above can get more, based on fill ratio. | Error 50011; sub-account limit error 50061. |
| Paribu | Per user. GET requests draw on 100,000 weight per minute (ticker 1, open orders 5, trade history 20). Standard users: 25 order creates and 25 cancels per second. Header `X-Quota-Remaining`. | HTTP 429 with `Retry-After` and a `retry_after` field. |

## WebSocket availability and connection limits

All 13 platforms document WebSocket access. Connection limits, subscription limits and keep-alive rules differ, and a reconnect loop can hit them quickly.

**WebSocket availability and connection limits, as read on official pages on 5 November 2026**

| Platform | Availability and endpoints | Published limits and keep-alive |
| --- | --- | --- |
| Binance | Yes. Market streams `wss://stream.binance.com:9443`. WebSocket API with order entry `wss://ws-api.binance.com:443/ws-api/v3`. | 300 connections every 5 minutes per IP. Streams: 1,024 per connection, 5 incoming messages per second. A connection lasts 24 hours; server ping every 20 seconds, disconnect without a pong within 1 minute. Connecting to the WebSocket API costs 2 weight. |
| Bitget | Yes. `wss://ws.bitget.com/v3/ws/public`, `/private`, `/public/sbe`. Orders can be placed over WebSocket. | 300 connection requests per 5 minutes and 100 connections per IP. 240 subscription requests per hour and 1,000 channels per connection; 10 messages per second. Send `ping` every 30 seconds; disconnect after 2 minutes without one. |
| BtcTurk | Yes. `wss://ws-feed-pro.btcturk.com`, with HMAC login. | 15 connection requests per minute, then new connections are blocked for 60 seconds. Subscriptions do not count. Keep-alive rule: not found on official pages, 5 November 2026. |
| Bybit | Yes. `wss://stream.bybit.com/v5/public/spot` and other markets, `/v5/private`, order entry `/v5/trade`. | 500 connections in 5 minutes per domain; 1,000 connections per IP for market data, counted per market. Spot: 10 args per request. Options: 2,000 args per connection. The Connect page also lists 100 args per connection for Spot and Futures, with the date marked TBD. The docs recommend `ping` every 20 seconds. |
| Coinbase Advanced Trade | Yes. Market data `wss://advanced-trade-ws.coinbase.com`, user data `wss://advanced-trade-ws-user.coinbase.com`. Global Derivatives `wss://drb.coinbase.com/ws/api/v2`, `wss://streams.drb.coinbase.com/ws/api/v2`. | Connections and unauthenticated messages: 8 each per second per IP (a second official page differs; see the conflicts below). Subscribe within 5 seconds of connecting or be disconnected. Most public channels close within 60 to 90 seconds with no updates; the docs say to subscribe to `heartbeats`. |
| Deribit | Yes, the interface the docs recommend for most uses. JSON-RPC at `wss://www.deribit.com/ws/api/v2`. | 32 connections per IP, and HTTP requests count while they run. 16 sessions per API key; the oldest is removed past that. Heartbeats through `public/set_heartbeat`, minimum interval 10 seconds. |
| Gate | Yes. Spot `wss://api.gateio.ws/ws/v4/`, Simple Binary Encoding (SBE) `wss://api.gateio.ws/ws/v4/ws/spot/sbe`. USDT futures `wss://fx-ws.gateio.ws/v4/ws/usdt`. Order channels such as `spot.order_place`. | 300 connections per IP. WebSocket orders: Spot 10 per second, futures 100 per second. Protocol-level ping and pong; `spot.ping` is optional. |
| Hyperliquid | Yes. `wss://api.hyperliquid.xyz/ws`, for subscriptions and as an alternative to HTTP requests. | Per IP: 10 connections, 30 new connections per minute, 1,000 subscriptions, 10 unique users, 2,000 messages per minute, 100 inflight posts. The server closes a connection it has sent nothing to for 60 seconds; send a ping. |
| Kraken | Yes. Spot `wss://ws.kraken.com/v2`, authenticated `wss://ws-auth.kraken.com/v2`, with order entry. Derivatives `wss://futures.kraken.com/ws/v1`, market and account data, no order entry. | Spot: about 150 connection attempts per rolling 10 minutes per IP, then a 10-minute ban; closed after about 1 minute idle. Derivatives: 100 connections, 100 requests per second; ping at least every 60 seconds. |
| KuCoin | Yes. UTA `wss://x-push-spot.kucoin.com`, `wss://x-push-futures.kucoin.com`, `wss://wsapi-push.kucoin.com`, order entry `wss://wsapi.kucoin.com`. Classic `wss://ws-api-spot.kucoin.com`, `wss://ws-api-futures.kucoin.com`. | UTA per IP: public Spot 500, public Futures 800, private 1,024 connections; 300 new connections per 5 minutes (public Futures 250). Per connection: 300 messages per 10 seconds public, 100 private; 600 or 400 topics. Classic: 800 connections, 100 messages per 10 seconds, 400 Spot topics. Ping at the `pingInterval` the server sends. |
| MEXC | Yes. Spot `wss://wbs-api.mexc.com/ws`, with protobuf channels. Futures `wss://contract.mexc.com/edge`, JSON or protobuf. | Spot: 30 subscriptions per connection, 100 requests per second, 24-hour connection life; dropped after 30 seconds with no valid subscription or 1 minute with no traffic. Futures connection limits: not found on official pages, 5 November 2026. |
| OKX | Yes. `wss://ws.okx.com/ws/v5/public`, `/private`, `/business`, with order placing, amending and canceling. | 3 connection requests per second per IP. 480 subscribe, unsubscribe and login requests per hour per connection. 30 connections per listed private channel per sub-account. Closed after 30 seconds without a subscription or data; send `ping`. Use port 443. |
| Paribu | Yes. `wss://api.paribu.com/stream`, public data. Beta: `wss://api.paribu.com/v1/wapi/stream`, `/v1/wapi/user`; the docs warn that format and channel names may change. | Beta, anonymous or standard user: 8 per IP or 32 per user open; 128 or 256 channels per connection; 24 per IP or 96 per user connection attempts per 5 minutes. Server ping every 20 seconds, closed without a pong within 30 seconds. Older streams: up to 100 connections per client. |

## Test environments and their caveats

A test environment is not always a copy of production. Some use the production host with a header, some return fixed responses, and some reset without notice. Tests show how software behaves, not future results.

**Test environment and caveats, as read on official pages on 5 November 2026**

| Platform | Test environment | Caveats on the official pages |
| --- | --- | --- |
| Binance | Spot Testnet `testnet.binance.vision`. Spot Demo Mode `demo-api.binance.com`. USD-M `demo-fapi.binance.com`. | Testnet: virtual funds, no `/sapi`; reset to blank about once a month with no prior notice (orders go, keys stay); prices independent of live; sometimes has features before live. Demo Mode: prices similar to live, limits stated as exactly the same as live, no orders during maintenance. Testnet limits differ from live; see the conflicts below. |
| Bitget | Demo trading: a Demo API key, header `paptrading: 1` on `api.bitget.com`, WebSocket `wss://wspap.bitget.com/v3/ws/public`, `/private`. | Virtual funds. The demo REST page says KYC is needed. A separate test REST host: not found on official pages, 5 November 2026. |
| BtcTurk | not found on official pages, 5 November 2026 | Code samples name `ws-feed-sandbox.btctrader.com` and `api-dev.btcturk.com`. No page describes them, and we did not test them. |
| Bybit | Testnet `api-testnet.bybit.com`, `stream-testnet.bybit.com`. Mainnet demo `api-demo.bybit.com`, `wss://stream-demo.bybit.com`. | Demo: its own user ID, not every API, orders kept for 7 days, default rate limit only; the demo stream is private only, with no WebSocket trade. The docs say not to create a key from testnet demo trading. |
| Coinbase Advanced Trade | Sandbox `api-sandbox.coinbase.com/api/v3/brokerage`, no authentication. | Static, predefined responses in the production format, for accounts and orders endpoints only. It can check parsing, not order logic. A test environment for Global Derivatives: not found on official pages, 5 November 2026. |
| Deribit | `test.deribit.com/api/v2`, `wss://test.deribit.com/ws/api/v2`, FIX `fix-test.deribit.com`. | Separate account and API keys. Rate-limit pools are tracked separately from production. |
| Gate | TestNet `api-testnet.gateapi.io/api/v4`, `wss://ws-testnet.gate.com/v4/ws/spot`, USDT futures `wss://ws-testnet.gate.com/v4/ws/futures/usdt`. | Separate from real trading. Real-trading keys do not work on TestNet. |
| Hyperliquid | `api.hyperliquid-testnet.xyz`, `wss://api.hyperliquid-testnet.xyz/ws`. | The faucet gives 1,000 mock USDC and requires a mainnet deposit from the same address. |
| Kraken | Derivatives: self-service `demo-futures.kraken.com`. Spot: UAT (a test environment) on request through an account manager. FIX UAT `fix.uat.kraken.com`. | Spot Beta WebSocket hosts use the production trading engine, so they are not a test environment. |
| KuCoin | not found on official pages, 5 November 2026 | Order test endpoints such as `POST /api/v1/hf/orders/test` check a request, and the order does not enter matching. |
| MEXC | not found on official pages, 5 November 2026 | No test host, sandbox or testnet appears on the pages read. `POST /api/v3/order/test` checks a Spot order request without sending it to the matching engine. |
| OKX | Demo trading: `openapi.okx.com` with a demo key and header `x-simulated-trading: 1`. WebSocket `wss://wspap.okx.com/ws/v5/public`, `/private`, `/business`. | Some functions are not supported, including withdrawal, deposit and purchase or redemption. Demo keys do not expire. |
| Paribu | not found on official pages, 5 November 2026 | No test host, sandbox or testnet appears on the pages read. |

## FIX availability

Four of the 13 document FIX access, each on different terms. Bybit says its FIX API covers Spot only, and Binance documents FIX under Spot.

**FIX availability, as read on official pages on 5 November 2026**

| Platform | FIX status | Details |
| --- | --- | --- |
| Binance | Yes, for Spot. USD-M FIX: not found on official pages, 5 November 2026. | `fix-oe.binance.com`, `fix-dc.binance.com`, `fix-md.binance.com`, port 9000 (9001 and 9002 for SBE), TLS. Ed25519 keys only; logon signs tags 35, 49, 56, 34 and 52. Order Entry: 15 connection attempts per 30 seconds, 10 connections, 10,000 messages per 10 seconds. Testnet hosts such as `fix-oe.testnet.binance.vision`. |
| Bitget | not found on official pages, 5 November 2026 | No mention on the pages read. |
| BtcTurk | not found on official pages, 5 November 2026 | No mention on the pages read. |
| Bybit | Yes, Spot only, by whitelist. | FIX 4.4 over TLS. `fix-oe.bybit.com:9000`, testnet `fix-oe-testnet.bybit.com:9000`. Self-generated RSA keys only; logon signs `GET/realtime + expires` with RSA-SHA256. Whitelisting is by UID or institution. Resend and gap fill are not supported. |
| Coinbase Advanced Trade | Not on Advanced Trade. | The Advanced Trade FAQ says FIX is not supported there. Coinbase Exchange, a separate product for institutional clients, [documents FIX 5.0 SP2](https://docs.cdp.coinbase.com/exchange/fix-api/connectivity). |
| Deribit | Yes. | A subset of FIX 4.4 with some FIX 5.0 and custom tags. `fix.deribit.com`, port 9881 (raw TCP) or 9883 (SSL); test `fix-test.deribit.com`. The client ID is the username, and the password is derived from the client secret. Starbase Drop Copy is for selected clients on private connectivity. |
| Gate | not found on official pages, 5 November 2026 | No mention on the pages read. |
| Hyperliquid | not found on official pages, 5 November 2026 | No mention on the pages read. |
| Kraken | Yes, through an account manager. | FIX 4.4 for Spot and Derivatives. `fix.kraken.com`, UAT `fix.uat.kraken.com`, ports 4000 to 4005, TLS 1.3, IP whitelisting. Trading sessions sign with HMAC-SHA512. |
| KuCoin | not found on official pages, 5 November 2026 | No mention on the pages read. |
| MEXC | not found on official pages, 5 November 2026 | No mention on the pages read. |
| OKX | not found on official pages, 5 November 2026 | The V5 docs do not mention FIX. A [support notice dated 8 December 2017](https://www.okx.com/help/suspension-the-fix-api-service) says the service was suspended from 9 December 2017 for an upgrade. |
| Paribu | not found on official pages, 5 November 2026 | No mention on the pages read. |

## Crypto exchange API documentation and changelog links

These are the main official pages behind the tables above, with the date of the newest changelog entry we saw.

**Official crypto exchange API documentation and changelogs, newest entries seen on 5 November 2026**

| Platform | Official documentation | Changelog and newest entry seen |
| --- | --- | --- |
| Binance | [Spot REST API](https://developers.binance.com/en/docs/products/spot/rest-api), [Spot WebSocket API](https://developers.binance.com/en/docs/products/spot/web-socket-api), [Spot FIX API](https://developers.binance.com/en/docs/products/spot/fix-api), [Spot Testnet](https://developers.binance.com/en/docs/products/spot/testnet/general-info), [Spot Demo Mode](https://developers.binance.com/en/docs/products/spot/demo-mode/general-info), [USD-M general info](https://developers.binance.com/en/docs/products/derivatives-trading-usds-futures/general-info) | [Spot](https://developers.binance.com/en/docs/products/spot/CHANGELOG): 30 October 2026. [Spot Testnet](https://developers.binance.com/en/docs/products/spot/testnet/CHANGELOG): 30 October 2026. [Derivatives](https://developers.binance.com/en/docs/products/derivatives-trading-usds-futures/change-log): 23 October 2026. |
| Bitget | [Quick Start](https://www.bitget.com/docs/uta/quick-start), [REST API](https://www.bitget.com/docs/uta/rest-api), [Demo trading](https://www.bitget.com/docs/uta/demo-trading/rest-api) | [Unified Trading Account](https://www.bitget.com/docs/uta/changelog/2026-11): 5 November 2026, with a separate [Update Preview](https://www.bitget.com/docs/uta/update-preview). [Classic](https://www.bitget.com/docs/classic/changelog/2026-11): 3 November 2026. |
| BtcTurk | [Authentication](https://docs.btcturk.com/docs/authentication/authentication-v1/), [Rate limits](https://docs.btcturk.com/docs/private-endpoints/rate-limits/), [WebSocket](https://docs.btcturk.com/docs/websocket-feed/authentication/), [FAQ](https://docs.btcturk.com/docs/faq-frequently-asked-questions/) | [Recent Changes](https://docs.btcturk.com/docs/recent-changes/): 6 May 2024. |
| Bybit | [Integration guide](https://bybit-exchange.github.io/docs/v5/guide), [Rate limits](https://bybit-exchange.github.io/docs/v5/rate-limit), [WebSocket](https://bybit-exchange.github.io/docs/v5/ws/connect), [Demo trading](https://bybit-exchange.github.io/docs/v5/demo), [FIX API](https://bybit-exchange.github.io/docs/fix-api/guide) | [V5](https://bybit-exchange.github.io/docs/changelog/v5): 5 November 2026. |
| Coinbase Advanced Trade | [Overview](https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/overview), [REST API](https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/rest-api), [Authentication](https://docs.cdp.coinbase.com/coinbase-app/authentication-authorization/api-key-authentication), [WebSocket endpoints](https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/websocket/websocket-endpoints), [WebSocket limits](https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/websocket/websocket-rate-limits), [Sandbox](https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/sandbox), [Global Derivatives overview](https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/guides/derivatives/overview), [FAQ](https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/faq) | [Coinbase App](https://docs.cdp.coinbase.com/coinbase-app/introduction/changelog): 1 October 2026. |
| Deribit | [Overview](https://docs.deribit.com/), [Authentication](https://docs.deribit.com/articles/authentication), [Rate limits](https://docs.deribit.com/articles/rate-limits), [Connections](https://docs.deribit.com/articles/connection-management-best-practices), [FIX API](https://docs.deribit.com/fix-api/production/overview) | [JSON-RPC](https://docs.deribit.com/changelogs/jsonrpc), [FIX](https://docs.deribit.com/changelogs/fix) and [Starbase](https://docs.deribit.com/changelogs/starbase): the top entry in each is dated 5 November 2026 and marked as postponed. The newest entries before it are 13 October 2026 for JSON-RPC and FIX and 29 October 2026 for Starbase. |
| Gate | [REST API v4](https://www.gate.com/docs/developers/apiv4/en/), [Spot WebSocket](https://www.gate.com/docs/developers/apiv4/ws/en/), [Futures WebSocket](https://www.gate.com/docs/developers/futures/ws/en/) | Inside each documentation page. REST: 3 November 2026. Spot WebSocket: 14 October 2026. Futures WebSocket: 22 October 2026. |
| Hyperliquid | [API](https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api), [Signing](https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/signing), [API wallets](https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/nonces-and-api-wallets), [Limits](https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/rate-limits-and-user-limits), [WebSocket](https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/websocket), [Heartbeats](https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/websocket/timeouts-and-heartbeats), [Testnet faucet](https://hyperliquid.gitbook.io/hyperliquid-docs/onboarding/testnet-faucet) | not found on official pages, 5 November 2026. |
| Kraken | [Overview](https://docs.kraken.com/exchange/guides/overview), [REST authentication](https://docs.kraken.com/exchange/guides/rest/authentication), [REST limits](https://docs.kraken.com/exchange/guides/rest/ratelimits), [Spot trading limits](https://docs.kraken.com/exchange/guides/general/ratelimits), [Derivatives limits](https://docs.kraken.com/exchange/guides/futures/ratelimits), [Derivatives REST](https://docs.kraken.com/exchange/guides/futures/rest), [Spot WebSocket](https://docs.kraken.com/exchange/guides/websockets/introduction), [Derivatives WebSocket](https://docs.kraken.com/exchange/guides/futures/websockets), [FIX](https://docs.kraken.com/exchange/guides/fix/introduction) | [Release notes](https://docs.kraken.com/exchange/changelog): 27 October 2026. |
| KuCoin | [Introduction](https://www.kucoin.com/docs-new/introduction-uta), [Authentication](https://www.kucoin.com/docs-new/authentication), [UTA limits](https://www.kucoin.com/docs-new/rate-limit-rule-uta), [Classic limits](https://www.kucoin.com/docs-new/rate-limit-rule-classic), [UTA WebSocket](https://www.kucoin.com/docs-new/websocket-api/base-info/introduction-uta), [Classic WebSocket](https://www.kucoin.com/docs-new/websocket-api/base-info/introduction), [Order test](https://www.kucoin.com/docs-new/rest/spot-trading/orders/add-order-test) | [Change Log](https://www.kucoin.com/docs-new/change-log): an entry dated 6 November 2026 is already listed. |
| MEXC | [Spot V3](https://www.mexc.com/api-docs/spot-v3/introduction), [Spot WebSocket](https://www.mexc.com/api-docs/spot-v3/websocket-market-streams), [Test order](https://www.mexc.com/api-docs/spot-v3/spot-account-trade/test-new-order), [Futures](https://www.mexc.com/api-docs/futures/integration-guide), [Futures WebSocket](https://www.mexc.com/api-docs/futures/websocket-api/native-ws-endpoint) | [Spot](https://www.mexc.com/api-docs/spot-v3/change-log): 23 October 2026. [Futures](https://www.mexc.com/api-docs/futures/update-log): 23 October 2026. |
| OKX | [API v5](https://www.okx.com/docs-v5/en/), [API Agreement](https://www.okx.com/help/okx-api-agreement) | [Change Log](https://www.okx.com/docs-v5/log_en/): 27 October 2026, with an Upcoming Changes section last updated 28 October 2026. |
| Paribu | [Introduction](https://docs.paribu.com/api), [API keys](https://docs.paribu.com/api/getting-started/obtaining-api-keys), [Scopes](https://docs.paribu.com/api/getting-started/scopes-and-permissions), [Signing](https://docs.paribu.com/api/getting-started/authentication-and-signing), [Rate limits](https://docs.paribu.com/api/error-handling/rate-limiting), [Streams](https://docs.paribu.com/api/streams/streams), [Streams beta](https://docs.paribu.com/api/streams-v2/overview) | not found on official pages, 5 November 2026. |

Our own Python guides, based on the same kind of official pages, cover [Binance](https://fincodelabs.com/en/blog/binance-api-python-trading-bot), [Bybit](https://fincodelabs.com/en/blog/bybit-api-python), [Coinbase Advanced Trade](https://fincodelabs.com/en/blog/coinbase-advanced-trade-api-python), [Hyperliquid](https://fincodelabs.com/en/blog/hyperliquid-api-python), [Kraken](https://fincodelabs.com/en/blog/kraken-api-python) and [OKX](https://fincodelabs.com/en/blog/okx-api-python). They were read on their own dates, so where a guide and this page differ, go by the official page.

## Where official pages disagree

These are conflicts we saw between official pages, or within one page. Test the behavior yourself before you rely on either version. We noticed none for Hyperliquid or Kraken on the pages read.

**Conflicts between official pages, as read on official pages on 5 November 2026**

| Platform | What the official pages say |
| --- | --- |
| Binance | The Testnet page says limits are generally the same as on the Spot API. Live `exchangeInfo` on 5 November 2026 showed Spot 100 orders per 10 seconds and 200,000 per day, against 50 and 160,000 on Spot Testnet. USD-M showed 2,400 weight per minute, against 6,000 on its demo host. |
| Bitget | The REST API page allows 10 API keys per UID; Quick Start allows 50. The REST API page lists `/v2/ws` hosts; Quick Start lists `/v3/ws`. Quick Start asks for a login timestamp in milliseconds, while its sample divides by 1,000 and shows a value in seconds. |
| BtcTurk | The FAQ says private endpoint limits are per account. The rate limit table marks private endpoints such as `/api/v1/users/balances` as per IP. Recent Changes (20 June 2022) raises `/api/v1/openOrders` to 330; the table shows 300. |
| Bybit | The rate limit page names `api.bybick.com`; the integration guide names `api.bytick.com`. The guide's signing steps say to add the signature to `X-BAPI-API-KEY`; its header list and examples use `X-BAPI-SIGN`. The limit of 100 args per connection is on the Connect page but not in the changelog, and its date read 26 November 2026 in our first read on 5 November 2026 and TBD in later reads that day. |
| Coinbase Advanced Trade | The Coinbase App WebSocket limit page gives 8 connections per second per IP; the [Coinbase Business copy](https://docs.cdp.coinbase.com/coinbase-business/advanced-trade-apis/websocket/websocket-rate-limits) gives 750. The sandbox page still lists `/intx/*` paths, which the REST page and changelog say were retired on 1 October 2026. The older REST rate limit address now redirects to the overview, which gives no figure. The WebSocket overview's JavaScript sample sets the JWT issuer to `cdp`; its Python sample sets `coinbase-cloud`. |
| Deribit | The rate limit page's upgrade example jumps from Tier 1 to Tier 4, while its table makes Tier 1 the highest-volume tier. |
| Gate | The authentication section says both 20 API keys per account and at most 5 keys per user. |
| KuCoin | The introduction says weight updates every 30 seconds; the rate limit pages say every 1 second, and the Classic page describes a 1-second window beside quotas per 30 seconds. The UTA page's example gives VIP5 700 per second; its table gives 900. The change log page shows a modified date of 3 November 2026 above an entry dated 6 November 2026. The [WebSocket error list](https://www.kucoin.com/docs-new/error-code/websocket) names 50 sessions and 300 subscriptions per session, which differs from the limit pages. |
| MEXC | The FAQ says access returns after 10 minutes. The limits section describes bans from 2 minutes to 3 days, with `Retry-After`. |
| OKX | The change log says port 8443 stops on the public internet from 31 October 2026. On 5 November 2026 the general section still said it would be retired soon. |
| Paribu | The scopes page says scopes cannot be customized at key creation; the key page offers a Custom option. The signing page says not to add an `/api` prefix; the rate limit table lists paths with `/api`. |

## What this page does not cover

Fees, products, legal status and account requirements are not compared here. A documented endpoint does not prove that a product is available to you, and it does not show that the platform's terms allow your use. OKX's overview, for example, treats continued use of its API as acceptance of its [API Agreement](https://www.okx.com/help/okx-api-agreement), and that agreement limits third-party and commercial use without OKX's written approval. Read each platform's terms as well.

Some global brands also run separate regional services with their own hosts and terms, and this page describes the global documents. BtcTurk and Paribu appear on the [provisional list of Türkiye's Capital Markets Board (SPK)](https://spk.gov.tr/kurumlar/kripto-varlik-hizmet-saglayicilar/faaliyette-bulunanlar-listesi), read on 5 November 2026; SPK says being listed does not mean a firm is authorized. The [guide to Turkish crypto exchange APIs](https://fincodelabs.com/en/blog/turkish-crypto-exchange-apis) covers platforms on that list. Many of the platforms above also offer derivatives, whose availability varies by country and whose leverage can increase losses.

## Questions about this comparison

### Which crypto exchange APIs have a test environment?

On the pages read on 5 November 2026, Binance, Bybit, Deribit, Gate and Hyperliquid publish separate test hosts. OKX and Bitget run demo trading through a header on the production REST host. Kraken has a self-service Derivatives demo and Spot test access on request. Coinbase Advanced Trade has a sandbox with fixed responses. None was found for BtcTurk, KuCoin, MEXC or Paribu.

### Which exchanges offer a FIX API?

Binance (Spot), Bybit (Spot, by whitelist), Deribit and Kraken (through an account manager) document FIX. Coinbase's FAQ says FIX is not supported on Advanced Trade. It was not found on official pages for the other eight platforms.

### How do exchange API rate limits differ?

Binance and Hyperliquid count weight per IP, with separate order or address limits. Bybit and OKX set limits per user per endpoint. Kraken's Spot REST API uses a counter per key, Deribit uses credits per sub-account, and KuCoin uses pools by VIP level. Going over can mean a retry header, a temporary ban or a closed session.

### Is this page a ranking or a recommendation?

No. Rows are alphabetical, there are no referral links, and being listed here is not a recommendation. Fincode has no affiliation with any platform on this page.

### What does "not found on official pages" mean?

It means the official pages we opened on that date did not show the item. It does not prove that the item does not exist, so check with the platform if it matters to your project.

### How current is this page?

Every cell was read on 5 November 2026. The page is updated by hand when we check, so read the linked official page before you rely on a number.

## Read more

- [Exchange API change log](https://fincodelabs.com/en/exchange-api-changes): API changes from official changelogs since 1 September 2026, newest first.
- [Binance API rate limit](https://fincodelabs.com/en/blog/binance-api-rate-limit): Weights, order counts, bans and a tested Python tracker.
- [Crypto exchange API integration](https://fincodelabs.com/en/blog/crypto-exchange-api-integration): REST and WebSocket, request signing, clock sync, rate limits, retries and testnets.

---

Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/exchange-api-comparison