Authentication errors across exchanges: a code-by-code map
Figures on this page are as of 2026-09. Fees, limits and margin tiers change — check the venue's own docs.
This is a lookup page. Find your venue and the code or string you got, and the table gives the venue’s own message, what it usually means, and the page that walks through the fix. Below the table, the same errors are grouped by failure class, because knowing the class tells you where to look before you open any page — and a few venue-specific traps are called out, since some of these codes do not mean what their neighbours on other venues mean.
Messages are quoted from each venue’s own error documentation unless marked otherwise.
Look up your error
| Venue | Code | Official message | Usually means | Page |
|---|---|---|---|---|
| Binance | -1021 | “Timestamp for this request is outside of the recvWindow.” / “…was 1000ms ahead of the server’s time.” | Clock drift, or latency against recvWindow | -1021 |
| Binance | -1022 | “Signature for this request is not valid.” | The signed string differs from what was sent | -1022 |
| Binance | -2014 | “API-key format invalid.” | The key string is malformed; Binance lists no causes | -2014 |
| Binance | -2015 | “Invalid API-key, IP, or permissions for action.” | Bad key, wrong IP, or missing permission | -2015 |
| Bybit | 10002 | “The request time exceeds the time window range.” | Timestamp outside the receive window | 10002 |
| Bybit | 10003 (REST) | “API key is invalid. Check whether the key and domain are matched…” | Key from a different environment than the host | 10003 |
| Bybit | 10003 (WS order entry) | “Too many sessions under the same UID” | Session count, not the key | 10003 |
| Bybit | 10004 | “Error sign, please check your signature generation algorithm.” | Pre-hash or encoding mismatch | 10004 |
| Bybit | 10005 | “Permission denied, please check your API key permissions.” | Key lacks the scope | 10005 |
| Bybit | 10010 | “Unmatched IP, please check your API key’s bound IP addresses.” | Calling IP not bound to the key | 10010 |
| OKX | 50101 | “APIKey does not match current environment.” | Demo key on live, or the reverse | 50111 |
| OKX | 50102 | “Timestamp request expired.” | More than 30 seconds from server time | 50102 |
| OKX | 50104 / 50105 | “Request header “OK-ACCESS-PASSPHRASE” cannot be empty.” / “…incorrect.” | Passphrase missing or wrong | Passphrase |
| OKX | 50110 | “Your IP {param0} is not included in your API key’s IP whitelist.” | IP binding | Permissions compared |
| OKX | 50111 | “Invalid OK-ACCESS-KEY.” | Key not recognised | 50111 |
| OKX | 50112 | “Invalid OK-ACCESS-TIMESTAMP.” | Malformed timestamp | Timestamps compared |
| OKX | 50113 | “Invalid signature.” | Pre-hash mismatch | 50113 |
| OKX | 50114 | “Invalid authorization.” | OKX gives no further detail | — |
| OKX | 50115 (HTTP 405) | “Invalid request method.” | Wrong HTTP method | — |
| Hyperliquid | string | “L1 error: User or API Wallet 0x… does not exist.” | The exchange recovered an address it does not know | Does not exist |
| Alpaca | HTTP 403 | Varies; read code and message | Credentials, buying power, wash-trade protection or account restriction | 403 |
| IBKR | 502 | “Couldn’t connect to TWS. Confirm that “Enable ActiveX and Socket Clients” is enabled…” | Socket could not open | 502 |
| IBKR | 326 | “Unable to connect as the client id is already in use. Retry with a unique client id.” | Client ID clash | 326 |
The same errors, by failure class
| Class | Codes | Look at |
|---|---|---|
| Key not recognised, or wrong environment | Binance -2014, -2015 (one of its causes); Bybit 10003 (REST); OKX 50101, 50111; Alpaca 401/403 | Which host, which key, stray whitespace from copy-paste |
| Signature | Binance -1022; Bybit 10004; OKX 50113; Hyperliquid “does not exist” | The pre-hash string — see signature methods compared |
| Timestamp | Binance -1021; Bybit 10002; OKX 50102, 50112 | The clock and the format — see timestamp tolerance compared |
| Permission or IP | Binance -2015; Bybit 10005, 10010; OKX 50110 | The key’s settings — see API key permissions compared |
| Connection or session | IBKR 502, 326; Bybit 10003 (WS order entry) | Processes, ports and client IDs |
The class matters more than the code. A signature error sends you to the signing code; a timestamp error means the signing code is probably fine; a permission error means both are fine and the key’s configuration is not.
Venue-specific traps
Binance: one code, three causes
-2015 covers a bad key, a disallowed IP and a missing permission. The fastest
split is GET /sapi/v1/account/apiRestrictions: if it answers, the key is valid
and the flags show whether IP or permission is the problem. A key with no IP
whitelist that suddenly cannot place orders while reads still work has usually
hit the 90-day expiry on spot and margin trading.
Bybit: 10003 forks on transport, and -2015 means something else
Over REST, 10003 is an invalid key, usually from the wrong environment. On
the WebSocket order-entry channel, the same number means too many sessions
under one UID. The fork is REST versus WebSocket order entry, not classic
versus unified account, as some older write-ups put it.
An expired Bybit key is -2015, “(Spot) Your api key has expired”, or 33004
on derivatives. That -2015 shares a number with Binance’s REJECTED_MBX_KEY,
so an error log spanning both venues must key on venue and code together.
OKX: the HTTP status will not help
Every code in OKX’s authentication class returns HTTP 401 except 50115, which
is 405. CCXT maps 50111–50115 to its AuthenticationError class. Whether a
demo key sent without the demo header returns 50101 or 50113 in practice,
OKX’s docs do not say; check the header before auditing the signer.
Hyperliquid: a signing bug reported as an unknown user
Hyperliquid recovers the signer’s address from the signature. If the signature is wrong, it recovers a different address and reports that it does not exist. Its docs say plainly: “An incorrect signature does not indicate why it is incorrect.” If the address in the error is neither yours nor your agent’s and changes between requests, it is a serialisation bug. Third-party sources (Tealstreet, Chainstack) also attribute the error to an expired or unapproved agent wallet; Hyperliquid’s own docs do not say that. A sibling string, “Must deposit before performing actions. User: 0x…”, is listed next to it.
Alpaca: 403 is not always about credentials
The API reference describes 403 on order placement as “Buying power or shares
is not sufficient.”, and wash-trade protection also returns 403. Alpaca’s own
Learn article adds that invalid credentials may return 403 instead of 401.
Read the code and message in the body before touching the keys.
IBKR: errors that never reach the server
502 is raised by the operating system when the socket cannot be opened, so
IBKR notes it “is not captured in TWS log files”. Check that TWS or IB Gateway
is running, socket clients are enabled, and the port matches. 326 means
another client already holds that client ID; a TWS session accepts up to 32
clients, each with a distinct ID.
What to do in code
Treat authentication errors as permanent. None of these clears on retry, and retrying consumes rate limit while hiding the cause. Fail loudly and stop trading — see error handling patterns.
Log venue, native code and message together. The numbers collide across venues, and several venues put the useful detail only in the message.
Authenticate once at startup. One cheap authenticated read on boot, such as
Alpaca’s /v2/account or Binance’s apiRestrictions, surfaces every error in
this table before the first order rather than during it.
If you use CCXT, catch the class, keep the code. AuthenticationError
tells you the category; the venue code tells you which row above you are on —
see CCXT’s common errors.
FAQ
Why does the same error code mean different things on different exchanges?
Each venue numbers its errors independently. Binance’s -2015 means an invalid
key, IP or permission, while Bybit’s -2015 means an expired spot key. Bybit’s
own 10003 means an invalid key over REST and too many sessions on WebSocket
order entry. Always interpret a code together with the venue and transport.
Which authentication errors mean my clock is wrong?
Binance -1021, Bybit 10002 and OKX 50102 all mean the request timestamp
fell outside the venue’s accepted window. OKX 50112 is different: the
timestamp was malformed rather than late. Synchronise the system clock with NTP
rather than widening the window.
Is it safe to retry after an authentication error?
Retrying will not help, because the cause is the key, the signature, the clock or the configuration, and none of those change between attempts. Repeated retries also consume rate limit. Fail fast, log the venue’s code and message, and fix the cause before sending again.
How do I tell a signature error from a key error?
Use the venue’s code. Binance separates -1022 (signature) from -2014 and
-2015 (key); Bybit separates 10004 from 10003; OKX separates 50113 from
50111. On Hyperliquid there is no separate code: a bad signature appears as
“User or API Wallet … does not exist” with an address that changes between
requests.