Testnet, demo and paper environments compared across venues
Figures on this page are as of 2026-09. Fees, limits and margin tiers change — check the venue's own docs.
“Use testnet first” is sound advice with a hidden assumption: that each venue has one testnet, at one obvious address, with its own keys. Binance has three practice environments across spot and futures. Bybit’s error message counts four environments. OKX’s demo trading is a header on the production REST host but a separate WebSocket host. IBKR’s paper account is a different login on a different port. Point the right key at the wrong host and you get an authentication error at best.
Practising on testnet before going live explains why the separation model matters. This page is the reference behind it: every host our fact cards record, where each environment’s keys come from, and whether a key from one environment works in another.
The matrix
| Venue and environment | REST | WebSocket | Keys come from | Does a live key work? |
|---|---|---|---|---|
| Binance Spot Testnet | https://testnet.binance.vision/api | Streams wss://stream.testnet.binance.vision/ws; WS API wss://ws-api.testnet.binance.vision/ws-api/v3 | testnet.binance.vision, with a GitHub login | No, and Demo Mode keys do not work here either |
| Binance Spot Demo Mode | https://demo-api.binance.com/api | WS API wss://demo-ws-api.binance.com/ws-api/v3; streams wss://demo-stream.binance.com/ws | Binance Demo Trading, from a normal account | No; keys are valid only on the demo-* hosts |
| Binance USDⓈ-M testnet | https://demo-fapi.binance.com | wss://demo-fstream.binance.com | Not documented in our fact card | Not documented in our fact card |
| Bybit testnet | https://api-testnet.bybit.com | We did not verify the WebSocket hosts | Testnet | No; a key/host mismatch returns 10003 |
| Bybit demo trading | https://api-demo.bybit.com | We did not verify the WebSocket hosts | Production, while in Demo Trading mode | No; same 10003 |
| OKX demo trading | https://openapi.okx.com plus header x-simulated-trading: 1 | wss://wspap.okx.com:8443/ws/v5/public, /private, /business | The Demo Trading “Personal Center” | No; mismatch is 50101 |
| Hyperliquid testnet | https://api.hyperliquid-testnet.xyz | Not documented in our fact card | No keys; wallet signatures name the network | Signatures do not cross networks |
| Alpaca paper | https://paper-api.alpaca.markets | Not documented per environment in our fact card | Paper account, separate from live | No; the result may be 401 or 403 |
| IBKR paper (TWS API) | Socket: TWS port 7497, IB Gateway 4002 (live: 7496, 4001) | — | A paper login in TWS or IB Gateway | No key; a separate login |
Across every row, the answer to “does my live key work here?” is no, or there is no key. What differs is what the mistake looks like when you make it.
Where the venues actually differ
Binance: two spot environments, and a futures host that moved
Spot Testnet and Spot Demo Mode are different environments. Testnet keys
are created on testnet.binance.vision with a GitHub login. Demo Mode keys are
created from a normal Binance account and work only on the demo-* hosts. A
key from one is invalid on the other, a likely cause of “invalid key” reports.
Spot Testnet supports only /api/* endpoints, not /sapi/*. That rules out
GET /sapi/v1/account/apiRestrictions, so a startup permission check written
for production cannot run against testnet unchanged.
For USDⓈ-M futures, the General Info page gives the testnet REST base as
https://demo-fapi.binance.com. Individual endpoint pages still show the older
https://testnet.binancefuture.com, which you may see in older examples; treat
General Info as authoritative. See
Binance testnet API keys.
Bybit: four environments, one error code
Bybit’s REST 10003 message spells it out: “API key is invalid. Check whether
the key and domain are matched, there are 4 env: mainnet, testnet, mainnet-demo,
testnet-demo”. Its FAQ names a key/domain mismatch as the most likely cause.
Demo trading is the confusing one. The key is created on Production while
the account is in Demo Trading mode, then used against api-demo.bybit.com.
Bybit also advises against using Demo Trading on Testnet. Japan and Hong Kong
accounts have their own regional testnet hosts (api-testnet.manepa.jp,
api-testnet.spark-fintech.com). See
Bybit testnet setup.
OKX: a header for REST, a host for WebSocket
Over REST, OKX demo trading uses the same host as production, selected by
x-simulated-trading: 1. Over WebSocket, demo has its own host,
wspap.okx.com. A client can therefore end up half in each: streaming demo
data while a REST call that lost its header reaches production.
OKX documents an environment-mismatch code, 50101, “APIKey does not match
current environment.” Whether a demo key sent without the header returns
50101 or a signature error in practice, the docs do not say. Demo trading
does not support some functions, “such as withdraw, deposit,
purchase/redemption”, and demo keys are exempt from OKX’s inactivity expiry.
Hyperliquid: the network is inside the signature
There is no key to confuse. Each signed action names its network: L1 actions
carry source: "a" for mainnet or "b" for testnet, and user-signed actions
carry hyperliquidChain: "Mainnet" or "Testnet", which the official SDK notes
prevents replaying an action on a different chain.
Funding a testnet account has two conditions people miss. The faucet requires having deposited on mainnet with the same address. And email (Privy) logins get a different address on mainnet and testnet, so the mainnet deposit does not count. Whether an API wallet approved on mainnet is also registered on testnet, we did not find documented; approve one on testnet. See Hyperliquid API setup.
Alpaca: identical spec, separate credentials, some exceptions
Alpaca’s docs: “The API spec is the same between the paper trading and live
accounts.” Only the key and base URL change, and the Python SDK sets the URL
through paper=True or paper=False. Market data is served from
https://data.alpaca.markets for both live and paper accounts.
“You cannot use your live account’s credentials with the paper API, or vice
versa.” Alpaca says the wrong pairing can return 401 or 403, so do not
build logic that expects one. Identical spec does not mean every endpoint
works: the Locates endpoints are documented as not available in paper. A newly
created paper account needs new keys. See
Alpaca paper trading API.
IBKR: a login and a port, not a host
Paper is a separate login in TWS or IB Gateway, and the session listens on its
own port. The ports are defaults, not constants: IBKR says they “can be modified
as desired”, and the port in TWS must match the one in your connect() call.
When they do not, the symptom is error 502. IBKR recommends testing all
programs in a paper environment first.
The Client Portal Web API adds a condition: whether you access a live account or its paper counterpart, the live account must be fully open and funded.
What to do in code
One environment setting selects host, key and header together. If the base URL, the credential and OKX’s demo header are separately editable, sooner or later one of them will disagree with the others.
Assert the environment at startup and log it. Log the host or port you connected to. On OKX, assert that the demo header is on every REST request and that the WebSocket host matches. On IBKR, log the port.
Keep separate credential slots per environment. A single “API key” field that holds whichever key you last pasted is how paper strategies meet live accounts.
Expect environment gaps. Binance testnet has no /sapi/*, Alpaca paper
lacks some endpoints, and testnet instruments and filters do not always mirror
production. A failure unique to one environment is often the environment. The
paper trading explainer covers why fills differ
too.
FAQ
Can I use my live API key on testnet?
No. On Binance, Bybit, OKX and Alpaca, practice environments issue their own credentials and reject keys from other environments. Hyperliquid has no API keys, but each signature names its network. IBKR has no API key; paper is a separate login on a separate port.
What is the difference between Binance Spot Testnet and Demo Mode?
They are separate environments. Spot Testnet keys come from testnet.binance.vision
with a GitHub login, work on testnet.binance.vision, and support only /api/*
endpoints. Demo Mode keys come from a normal Binance account via Demo Trading
and work only on the demo-* hosts. A key from one does not work on the other.
Does OKX have a separate demo trading URL?
For WebSocket, yes: demo uses wss://wspap.okx.com:8443. For REST, no: demo
trading uses the production host with the header x-simulated-trading: 1. A
missing header sends the request to production, which is why the header is
worth asserting in code.
Why can’t I get Hyperliquid testnet funds?
The testnet faucet requires a previous mainnet deposit from the same address. Email (Privy) logins receive different addresses on mainnet and testnet, so a deposit made under the mainnet address does not qualify the testnet one.