API Keys

GET /api/v1/api-keys · POST /api/v1/api-keys · PUT /api/v1/api-keys/{id} · DELETE /api/v1/api-keys/{id}

Create, list, update and delete the API keys used to sign /fapi requests. These endpoints live on the native API and require a JWT from the EIP-712 login — keys cannot create other keys.

Auth: Authorization: Bearer <JWT>

Rules

• At most 30 keys per account per deployment (LIMIT_REACHED, HTTP 400, beyond that).
• secret_key is returned once, in the create response. It is never retrievable again; rotate by creating a new key.
• permissions is always trading,deposit — no key can withdraw.
• ip_whitelist is optional; when set, the first X-Forwarded-For hop must match one of the comma-separated entries or requests fail with IP_NOT_ALLOWED (403).
• Keys are per chain: create one on each deployment you use.

Create — POST /api/v1/api-keys

{ "label": "My Trading Bot", "ip_whitelist": "192.168.1.100" }

Field	Required	Notes
label	no	Free-form name
ip_whitelist	no	Comma-separated IPs; empty = unrestricted

Response — 200

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "api_key": "a1b2c3d4e5f6…(64 hex)",
  "secret_key": "f6e5d4c3b2a1…(64 hex, shown once)",
  "label": "My Trading Bot",
  "ip_whitelist": "192.168.1.100",
  "permissions": "trading,deposit",
  "created_at": "2026-03-09T00:00:00Z",
  "status": "active"
}

HTTP	code	Cause
400	LIMIT_REACHED	Already 30 keys
400	INVALID_IP	Malformed ip_whitelist
401	INVALID_TOKEN	Missing / expired JWT

List — GET /api/v1/api-keys

[
  {
    "id": "550e8400-…",
    "api_key": "a1b2c3d4…",
    "label": "My Trading Bot",
    "ip_whitelist": "192.168.1.100",
    "permissions": "trading,deposit",
    "created_at": "2026-03-09T00:00:00Z",
    "last_used_at": "2026-03-09T01:00:00Z",
    "status": "active"
  }
]

last_used_at is refreshed on every successful signed request.

Update — PUT /api/v1/api-keys/{id}

{ "label": "Updated Label", "ip_whitelist": "10.0.0.1", "status": "disabled" }

status is active or disabled; a disabled key answers API_KEY_DISABLED on the next signed request. All fields optional.

Delete — DELETE /api/v1/api-keys/{id}

204 No Content. Deletion is immediate; the next signed request answers INVALID_API_KEY.

Using a key

Send X-MBX-APIKEY: <api_key> and sign with secret_key as described in Signing. The Quickstart has a complete Python example.