Learn

Exchange APIs

Key permissions, testnet setup, IP whitelists, rate limits and the error codes you will actually hit, per exchange.

• Surviving exchange API changes

  Endpoints get deprecated, fields get added, and libraries rewrite themselves. What breaks silently, and how to find out before your positions do.

• Choosing an exchange for automation

  The API properties that decide how much work an integration is — and they are not the ones exchanges advertise.

• Backfilling trade and price history

  Pagination, archive endpoints and retention limits. The three things that make historical data harder to collect correctly than it looks.

• Position reconciliation

  The single check that catches the failures nothing else reports. What to compare, how often, and what to do when the numbers disagree.

• Order lifecycle and partial fills

  An order is not filled or unfilled. It moves through states, and the partially-filled one breaks more automation than any other single case.

• Exchange outages and degraded mode

  Venues go down, and they go down badly more often than they go down cleanly. What your automation should do when it cannot tell what is true.

• Using sub-accounts for automation

  A funding boundary bounds damage from correct-but-wrong behaviour, which no permission flag does. The strongest control available for third-party code.

• Monitoring a trading integration

  The failures that cost money are the silent ones — a stale stream, an expired permission, a position that drifted. What to alert on and what to ignore.

• Secrets management for trading automation

  Where exchange credentials actually leak — logs, shell history, synced dotfiles, MCP config files — and how to make a leak cost less when it happens.

• Error handling patterns for trading APIs

  Classify before you react. Most trading integration bugs come from treating a refusal and an unknown outcome as the same kind of failure.

• Symbol filters and minimum order sizes

  Your order is rejected before it reaches the matching engine because it failed a per-symbol filter. What the filters are and why they break sizing logic.

• WebSocket reconnection patterns

  A stream that reconnects silently leaves your state wrong with no error. Reconnection is not the hard part — reconciling what you missed is.

• Clock sync and timestamp errors

  Signed requests carry a timestamp inside a narrow window. Drift produces authentication failures that look exactly like signing bugs, and the fix is not in your code.

• Order types explained

  Market, limit, stop, stop-limit and the flags that modify them. What each guarantees, what it does not, and which guarantee you are giving up.

• Getting started with CCXT

  One interface across many exchanges, with a unified error hierarchy that is the real reason to use it — and the venue differences it cannot hide from you.

• Alpaca paper trading API

  Paper and live share one API specification and differ only by URL and credentials — which makes migration trivial and pointing at the wrong one equally trivial.

• Hyperliquid API setup and agent wallets

  There is no API key. A master account approves a wallet to sign for it — which changes what permissions mean and why a new account runs out of requests.

• Bybit testnet setup

  A separate hostname and separate credentials, so environment mistakes fail loudly. What carries over to mainnet and the account-type difference that does not.

• WebSocket vs REST for trading

  Streams are for knowing, requests are for doing — and the mistake that matters is polling for data you should stream, which spends the budget you need to exit.

• Binance API rate limits and error -1003

  Binance meters request weight, not request count — so "how many calls per minute" is the wrong question. What -1003 means and how 418 differs from 429.

• Binance testnet API keys

  Testnet is a separate host with separate credentials, which makes environment mistakes fail loudly. What transfers to production and what quietly does not.

• What to do if an exchange API key leaks

  Revoke first, investigate second — and know the venue-specific traps, including the one where revoking a key does not stop the signer.

• Exchange API key security checklist

  The controls that hold when your software is wrong, across five venues — including the one with no API keys and the one that ships safe by default.

• OKX API error 50113 "Invalid Sign"

  The signature you computed does not match OKX's. Five causes in order of likelihood, including the one that makes some endpoints work and others fail.

• OKX API passphrase and the four-header model

  OKX needs a fourth credential that Binance and Bybit do not have, and switches to demo trading with a header rather than a hostname. Both surprise people.

• Bybit API error 10003

  This code means two unrelated things depending on your account type — too many sessions on classic, an expired key under UTA. How to tell which you have.

• Bybit API key setup and request signing

  Bybit V5 uses four headers and a pre-hash string that does not match Binance or OKX. The construction, the common signing failures, and how to tell them apart.

• Disabling withdrawals on a Binance API key

  You do not disable withdrawals on Binance — you decline to meet the precondition for enabling them. Why that is a stronger guarantee than a checkbox.

• Binance API IP whitelist and the 90-day expiry

  Without an IP whitelist, a Binance key's spot trading permission switches itself off after 90 days. Why that happens, and how to find the address to whitelist.

• Binance API key permissions

  What each permission flag on a Binance key actually controls, how to read a key's real state over the API, and the two rules that make the model different from other venues.

• CCXT's common errors, and what they mean

  The exception hierarchy splits into "the exchange refused you" and "the outcome is unknown". Which branch an error lands in decides whether retrying is safe.

• IBKR TWS API setup

  Two defaults decide whether the TWS API works at all — socket clients are off, and Read-Only API is on. Ports, connection, and the constraints you cannot engineer around.

• Read-only vs trade permission on an API key

  Every venue implements the read/trade split differently — and on one of them the safe setting is the default. A comparison across five venues and what it implies.

• Binance API error -2015, and how to tell which cause you have

  One code covering three unrelated problems — a bad key, the wrong IP, or a missing permission. A decision procedure that identifies which one you have in a few minutes.

• Retrying a failed order is not safe

  A timeout on an order means the outcome is unknown, not that it failed. And a client order ID does not make the retry idempotent the way most advice claims.