Crypto API trading: API keys, permissions, bots and risks
Crypto API trading explained: how exchange APIs work, safe API key permissions, IP allow-lists, rate limits, trading bots and which EU exchanges offer an API.
Crypto API trading means connecting software to a crypto exchange through its API, so a program can read market data and place or cancel orders for you. You create an API key in your exchange account, give it limited permissions, and your script, bot or tool uses that key to trade around the clock. The convenience comes with a new risk: whoever has your key can trade your account.
This guide covers how exchange APIs work, how to set up keys safely (never with withdrawal rights), IP allow-lists, rate limits, trading bots and their risks, and which exchanges in our data offer an API to EU residents. Automated trading doesn’t make crypto less volatile: you can still lose all the money you put in.
What is crypto API trading?
Crypto API trading is placing trades through an exchange’s application programming interface instead of its app. Your software sends requests, such as “get the BTC/EUR price” or “buy 0.01 BTC at €60,000”, and the exchange answers in a machine-readable format, usually JSON.
Two kinds of cryptocurrency APIs are worth separating:
- Exchange APIs: run by the exchange itself. They give access to that exchange’s market data and, with a key, to your account and order execution.
- Market data APIs: run by data companies that collect exchange data from many venues into one feed. They suit research, analytics tools and a portfolio tracker, but you can’t trade through them.
Crypto trading never closes, which is the main reason people automate it. A program can watch the crypto market at 3am; you probably shouldn’t.
Public and private API access
Exchange APIs have a public part and a private part. Public endpoints return market data that anyone can read without an account; private endpoints need an API key and touch your balances and orders.
- Public: prices, order books, recent trades, trading pairs and historical data.
- Private: balances, open orders, trade history, placing and cancelling orders, and on some exchanges withdrawals.
We use public endpoints ourselves: the coin counts in several of our reviews come from the public instrument lists of exchanges such as Kraken, Bybit EU and OKX. Kraken’s asset-pairs endpoint, for example, returns every live trading pair in a single request.
REST API, WebSocket streams and FIX
Most exchanges offer two ways to connect, and some professional platforms add a third. Pick the one that fits how fast your strategy needs data.
| Connection | How it works | Good for |
|---|---|---|
| REST API | Your program sends a request and gets one response | Placing orders, checking balances, downloads |
| WebSocket streams | The exchange pushes updates over an open connection | Live prices and order books |
| FIX | A financial-industry protocol for fast order flow | Institutions and market makers |
Each API call is a small request with headers, such as your key and a signature, and sometimes a request body with the order details. The endpoint returns data or an error status you need to handle.
API keys and permissions
An API key is a pair of credentials, usually a public key and a secret, that lets software act on your account within the permissions you choose. Treat the secret like a password: anyone who has it can do whatever the key allows.
Most exchanges let you set permissions per key. The rule is simple: give each key the least it needs.
| Permission | What it allows | Give it to a bot? |
|---|---|---|
| Read or query | See balances, orders and history | Yes, for trackers and tax tools |
| Trade | Place and cancel orders | Only for a bot that trades |
| Withdraw or transfer | Move funds out of the account | Never |
A portfolio tracker or tax tool only needs read access. A trading bot needs read and trade. No legitimate bot needs withdrawal rights, and a service that asks for them is a red flag.
How to create an API key safely
Creating credentials takes a few minutes, but each step closes a gap an attacker could use. Menu names differ per exchange, so check its documentation.
- Turn on two-factor authentication first, ideally a passkey. Our 2FA guide shows how.
- Create one key per tool, with a clear label, so you can delete one without breaking the others.
- Tick only the permissions it needs: read, and trade if it places orders. Leave withdrawals off.
- Add an IP allow-list with the address of the server your bot runs on.
- Copy the secret once and store it securely, in a password manager or a secrets store, never in your code, a chat or a screenshot. Many exchanges show it only once.
- Set an expiry date if the exchange offers one, and delete keys you no longer use.
IP allow-listing
An IP allow-list (or whitelist) restricts an API key to requests from addresses you name. If someone steals the key, they can’t use it from their own computer.
Run your bot on a server or service with a fixed IP address, add that address to the key, and nothing else. If your tool runs on a home connection whose address changes, the key will stop working each time it does, which is still safer than leaving the key open to every address.
Rate limits
Every exchange limits how many requests you can send in a period, to protect its infrastructure. If you exceed the limit, the exchange rejects requests, usually with an error status, and repeated breaches can lock the key for a while.
Limits differ per exchange, per endpoint and sometimes per account tier, so check the docs before you build. Three habits keep you within them:
- Use WebSocket streams for live data instead of asking for prices every second.
- When you get a rate-limit error, wait and retry with growing pauses, instead of retrying at once.
- Cache data that doesn’t change often, such as the list of trading pairs.
Crypto market data: live and historical
Crypto market data comes in three main feeds: the ticker (latest price), trades (each fill) and the order book (open buy and sell orders). Your bot uses them to decide, and their reliability decides how good those decisions are.
Historical data and backtesting
Historical data lets you test a strategy on past prices before you risk money. Most exchanges offer OHLCV candles (open, high, low, close, volume) through their API; some also offer tick-level data or downloadable flat files such as CSV exports.
Backtesting has a catch: a strategy tuned to fit the past often fails in the future. Test on a period you didn’t use to build the strategy, and include fees and slippage.
Symbols and data quality
Each exchange names assets and pairs its own way. Kraken’s API, for example, uses XBT for bitcoin, while most exchanges use BTC, so BTC USD and BTC/EUR can look different from venue to venue. Aggregated cryptocurrency market data services normalise these symbols; if you connect directly to several exchanges, you have to do it yourself.
Fiat currencies and euro pairs
For EU traders, check which fiat currencies an exchange quotes before you build. Trading in euros avoids a conversion step and makes your profit and loss easier to track.
Among the exchanges in our data, Bitvavo quotes in euros only, Kraken supports seven fiat currencies including EUR, USD and GBP, OKX Europe and Bybit EU support EUR and PLN, and Gate EU supports EUR. Stablecoin pairs such as BTC/USDC are common too, but each swap between euros and a stablecoin is another trade with another fee.
Build automated trading: a basic workflow
Automated trading strategies follow the same loop, whatever the code: read data, decide, send an order, check the result and log it. Keep each step simple enough to check by hand.
- Read data from a WebSocket stream or REST endpoint.
- Apply your rule, for example a moving-average signal from technical analysis.
- Send the order as an API call, using a limit order where you can to pay the lower maker fee.
- Confirm that the exchange accepted and filled it.
- Log everything, including errors, for debugging and tax reporting.
Start with paper trading, then trade small amounts. Some exchanges offer a test environment; check the developer documentation.
Trading bots and their risks
A trading bot is software that runs a strategy for you through an API. It removes emotion and works 24/7, but it also repeats mistakes at machine speed.
The main risks:
- Bugs: a loop that places the same order a hundred times, or a decimal error that buys ten times too much.
- Strategy risk: a bot only follows its rules. In a market it wasn’t built for, it keeps losing.
- Key theft: if a bot service or your server is hacked, attackers get every key stored there. Read-only or trade-only permissions and an IP allow-list limit the damage.
- Exchange downtime: an outage or a changed endpoint can leave orders open.
- Fees: a bot that trades often pays fees on every trade, which can wipe out small gains.
- Scams: “profitable bots” sold with promised returns, and AI agent tools that ask for full account access, deserve deep suspicion.
If your bot trades derivatives or uses leverage, the risk is higher still: most retail traders who use leverage lose money. Our guide to crypto derivatives explains why. Copy trading and bot copy trading on unlicensed global platforms, such as Bitget’s, are not offered under an EU authorisation.
Which exchanges offer an API for EU residents?
Most MiCA-authorised exchanges in our data publish an API. We list them neutrally; compare the documentation, rate limits and fees yourself.
| Exchange | API | Euro trading | Entry spot fees (maker / taker) |
|---|---|---|---|
| Kraken | Yes | EUR and six other fiat currencies | 0.40% / 0.80% |
| Bitvavo | Yes | EUR only | 0.15% / 0.25% |
| Bybit EU | Yes | EUR, PLN | 0.25% / 0.25% |
| OKX Europe | Yes | EUR, PLN | 0.20% / 0.35% (0.08% / 0.10% with an X-Perps account) |
| Crypto.com Exchange | Yes | EUR and other fiat | 0.25% / 0.50% |
| Coinbase Advanced | Yes | EUR, GBP, USD | 0.60% / 1.20% (may differ for EU accounts) |
| Gate EU | Not confirmed for EU accounts; check the docs | EUR | 0.10% / 0.10% |
Fees were checked on 23 October 2026. Binance, MEXC, Bitget and KuCoin also offer APIs, but none of them holds an operating MiCA authorisation for EU residents, so we don’t recommend building on them if you live in the EU.
What API trading costs: a worked example
API orders pay the same trading fees as any other order, so fees decide whether a frequent strategy can work. Say your bot places 20 taker orders of €250 a month, €5,000 in total:
| Exchange | Taker fee | Monthly cost | Yearly cost |
|---|---|---|---|
| Bitvavo | 0.25% | €12.50 | €150 |
| OKX Europe (no X-Perps account) | 0.35% | €17.50 | €210 |
| Kraken | 0.80% | €40.00 | €480 |
With maker orders the same volume costs €7.50 a month at Bitvavo and €20 at Kraken. Our guide to crypto exchange fees compares all costs.
Check security, licensing and MiCA
Before you connect any tool, check two things: that the exchange is MiCA-authorised for your country, and that the tool itself deserves your key. Since 1 July 2026 only MiCA-authorised providers may offer crypto services in the EU.
A program you write and run yourself is just software. A third-party service that manages your portfolio or executes orders for you may itself need authorisation, so check who runs it, where it is supervised and what it does with your keys. Our guide on how to keep your crypto safe covers the account side.
Test an API before trading
Test with public endpoints first, then with a read-only key, and only then with a trade key and small orders. Each step catches a different kind of error.
- Call a public endpoint and check the data against the exchange’s website.
- Compare your server’s clock with the exchange’s server time; signed requests fail if the timestamp is off.
- Send a request with a wrong key on purpose and check that your code handles the error.
- Place one small limit order far from the price, then cancel it.
Choose the right setup for your goal
Match the tool to the job. A market data API suits research; an exchange API with a read-only key suits tracking and tax reports; a trade key on a MiCA-authorised exchange suits automated trading you have tested.
If you are new to crypto, skip bots for now. Learn how orders and fees work by hand first, and remember that automation can lose money faster than you can.
Questions people ask
What is an API in crypto trading?
An API (application programming interface) lets software talk to an exchange directly: it can read market data, check your balance and place or cancel orders without you clicking in the app. You connect it with an API key you create in your account settings.
Is a crypto exchange API free?
Exchange APIs are usually free to use, but every order you place through them pays the exchange's normal trading fees. Market data providers that combine many exchanges often charge by plan or by number of requests.
Should I enable withdrawals on an API key?
No. A trading bot never needs to withdraw funds, and a stolen key with withdrawal rights can empty your account. Give each key only read and trade permissions, and add an IP allow-list.
Which crypto exchange has the best API?
That depends on what you build. For EU residents, start with a MiCA-authorised exchange that publishes an API, such as Kraken, Bitvavo, Bybit EU, OKX or Coinbase, and compare its documentation, euro pairs, fees and rate limits.
Do crypto trading bots make money?
Some do for a while; many don't. A bot only follows its rules, so a weak strategy loses faster, and fees on every trade eat into small gains. Anyone selling a bot with promised returns is a red flag.