How to Check API Key Permissions on Bybit

Understanding API Key Permission Levels

1. Bybit categorizes API permissions into three distinct tiers: read-only, trading, and withdrawal.

2. Read-only access allows retrieval of market data, account balances, order history, and position information without modifying any state.

3. Trading permission enables placing, canceling, and modifying orders across spot, margin, and derivatives markets.

4. Withdrawal permission grants the ability to initiate fund transfers out of the Bybit account — a privilege that requires explicit manual activation and additional security verification.

5. Each permission level is assigned during API key creation and cannot be altered retroactively without generating a new key pair.

Locating Your API Key Dashboard

1. Log in to your Bybit account using verified credentials and complete 2FA authentication.

2. Navigate to the top-right user menu and select “API Management” under the “Security Center” section.

3. The dashboard displays all active API keys with their associated labels, creation timestamps, and IP binding status.

4. Click the “Details” button next to any key to reveal its full configuration including permission flags and whitelisted IPs.

5. Keys marked as “Testnet Only” appear separately and are isolated from mainnet operations by design.

Verifying Permission Flags via API Response

1. Send a GET request to /user/info endpoint using your API key and secret signature.

2. Include the required headers: X-BAPI-API-KEY, X-BAPI-SIGN, X-BAPI-TIMESTAMP, and X-BAPI-RECV-WINDOW.

3. A successful response returns a JSON object containing permissions field listing enabled capabilities as boolean values.

4. If the response includes 'withdraw': true, the key has withdrawal authority — this value should remain false unless explicitly required.

5. Any missing or inconsistent permission indicators suggest misconfiguration or incomplete key initialization.

Interpreting Permission Restrictions in Practice

1. An API key with only read permissions will return HTTP 403 when attempting to POST to /order/create.

2. Attempting to call /asset/withdraw with a non-withdrawal key triggers error code 10004 and descriptive message “No permission for withdrawal”.

3. Trading endpoints enforce strict validation: submitting an order with leverage parameters on a key lacking derivatives permission yields error 11001.

4. Rate limiting behavior changes based on permission scope — trading keys face stricter weight-based quotas than read-only keys.

5. IP-bound keys fail silently if requests originate outside the registered address range, regardless of permission level.

Frequently Asked Questions

Q: Can I downgrade an API key’s permission after creation? No. Bybit does not support modifying permissions on existing keys. You must deactivate the current key and generate a new one with the desired settings.

Q: Why does my API key show “Trading: false” even though I selected it during setup? This occurs when the key was created before enabling Futures or Derivatives trading in your account settings. Enable those modules first, then regenerate the key.

Q: Is there a way to audit which endpoints my key has successfully accessed? Yes. Bybit logs all authenticated API calls in the “API Activity History” tab within the API Management interface, showing timestamp, endpoint, and response code.

Q: What happens if I bind an API key to an IP address and later change networks? Requests from unlisted IPs receive HTTP 401 with error code 10002. You must update the IP whitelist or disable binding to restore functionality.