How to Get Bybit API Keys? (Developer Settings)

Accessing Developer Settings on Bybit

1. Log in to your Bybit account using valid credentials and two-factor authentication.

2. Navigate to the top-right corner of the dashboard and click on your profile icon.

3. Select API Management from the dropdown menu.

4. Ensure you are on the Developer Settings tab, not the Trading API or Webhook sections.

5. Review the security warning displayed before proceeding to generate new keys.

Creating a New API Key Pair

1. Click the Create API Key button located prominently on the page.

2. Enter a descriptive name for the key—this helps distinguish its purpose later, such as “TradingBot_v2” or “PriceAlertService”.

3. Choose appropriate permissions: Read-only, Trade, or Withdrawal. Avoid granting withdrawal access unless absolutely necessary.

4. Set an IP whitelist by entering one or more IPv4 addresses. This restricts API usage to trusted machines only.

5. Confirm creation using your hardware wallet signature, Google Authenticator code, or email verification depending on your 2FA setup.

Securing Your API Credentials

1. Immediately copy both the API Key and Secret Key into a secure offline storage location.

2. Never paste these values into public code repositories, chat messages, or browser console windows.

3. Enable Key Expiry if available in your account tier—some institutional plans support time-bound keys.

4. Rotate keys every 90 days or after any suspected compromise, even if no anomalous activity is observed.

5. Use environment variables instead of hardcoding credentials in scripts or configuration files used for bot operations.

Testing Your API Integration

1. Initiate a simple GET request to /v5/market/tickers using your newly created API Key and signature headers.

2. Verify that the response contains valid ticker data without HTTP 401 or 403 errors.

3. Attempt a test order placement if trade permissions were granted—use a minimal quantity and ensure it’s canceled immediately after confirmation.

4. Monitor the API Call Logs section within Developer Settings to confirm timestamps, endpoints, and status codes.

5. Cross-check rate limit consumption shown in response headers like X-RateLimit-Remaining against documented thresholds.

Frequently Asked Questions

Q: Can I reuse the same API Key across multiple trading bots?A: Yes, but it increases risk exposure. A single compromised key could impact all connected services simultaneously. Isolating keys per application improves accountability and containment.

Q: Why does Bybit require IP whitelisting for certain permission levels?A: IP restrictions add a network-layer defense against unauthorized access attempts originating outside pre-approved infrastructure, especially critical for high-privilege keys handling funds or order execution.

Q: What happens if I lose my Secret Key after creation?A: Bybit does not store or recover Secret Keys. You must delete the compromised key and generate a new pair. No exceptions exist—even support teams cannot retrieve it.

Q: Do API keys work identically across Bybit’s Spot, Futures, and Options markets?A: Yes, provided the correct base URL and endpoint paths are used. However, permissions apply globally—trade access enables orders in all supported product types unless explicitly restricted via scope-based tokens in newer API versions.