What are HitBTC API keys?
API keys are unique identifiers used to authenticate private requests in HitBTC API.
Public market data is available without authentication, but all requests associated with account management require authentication via API keys.
API keys can be used to gain access to a full range of our platform’s features through a programming interface.
API key consists of two parts:
- Public API key - your API identifier.
- Secret key - secret part used to sign your requests to our API. Make sure to keep it secret.
How to create an API key?
Creating an API key is as simple as accessing your API setting page and clicking the “New API key” button:
Clicking it will create and show you an active Public API key and Secret key without any access rights. Further accessing this page will hide the secret key, so saving it somewhere safe is very important. As Secret key is used to sign requests, it is vital to keep it safe and never show it to anyone.
Note: If you lose your secret key, you won't be able to use this API key anymore. You will need to create a new one.
API keys management
API key access rights
For your convenience, it is possible to restrict certain actions in a certain key. By checking corresponding checkboxes you might separately grant access to:
- Order book, History, Trading balance (viewing exchange data and trading history and Spot balance of your account);
- Place/cancel orders (managing your active orders and creating new ones);
- Payment information (generate/view deposit addresses, review Wallet account balances);
- Withdraw cryptocurrencies.
This might be useful if you want a certain program to have access only to a certain type of requests, restricting it from gathering data you don’t want it to gather.
Granting access rights for managing orders and initiating withdrawals will require confirmation via email and 2FA code (if enabled).
You also have an option to grant All rights to an API key by checking the “Allow all” box - easily and quickly.
Revoking, enabling and deleting an API key
To revoke (deactivate) an API key you would just need to set the ON/OFF switch to the OFF position at your API keys settings page. To re-enable it you would need to set it to the ON position.
A revoked key is not capable of authenticating requests. It might be a good idea to have a key revoked if you don’t plan to use it in the nearest future.
Alternatively, you might completely delete the key by clicking the trash bin icon:
A deleted API key can not be retrieved and can not be used to authenticate requests. It is a good idea to delete a key if it may have been compromised.
Security measures
Operations initiated through API (initiating withdrawals, placing orders, etc.) require neither the 2FA code nor an email confirmation. API and Secret keys are sufficient to initiate those actions through a programming interface. Therefore, it is essential to keep them safe.
Here are some tips:
- Keep track and audit your keys’ access rights once in a certain period of time;
- Use different keys for different services;
- Never share your API and Secret keys with anyone, including HitBTC representatives;
- Always thoroughly check the software you’re planning to use. There is always a chance that it has some hidden features or was designed to steal your personal data.