How to create API keys for my KuCoin account?

Accessing the API Management Section

1. Log in to your KuCoin account through the official website using your registered email and password. Ensure that two-factor authentication is enabled for added security before proceeding.

2. Once logged in, navigate to the top-right corner of the dashboard and click on your profile icon. From the dropdown menu, select “API” to enter the API management interface.

3. This section allows you to view existing API keys, create new ones, and manage permissions. If this is your first time creating an API key, the list will be empty, prompting you to generate a new one.

Generating a New API Key

1. Click on the “Create API” button located within the API management panel. A pop-up window will appear requesting essential details for key generation.

2. Enter a custom name for your API key to help identify its purpose—such as “TradingBot” or “PortfolioTracker.” This label does not affect functionality but aids in organization.

3. Set the passphrase used to encrypt the API secret. This passphrase is critical and cannot be recovered if lost, so store it securely. Confirm the passphrase in the repeated field.

4. Choose the permission level: 'General,' 'Trade,' 'Withdraw,' or 'Deposit.' For most third-party applications, 'Trade' permissions are sufficient. Avoid selecting 'Withdraw' unless absolutely necessary.

5. Complete the CAPTCHA challenge and click “OK” to generate the key pair. The system will display your API key, secret key, and passphrase only once.

Securing and Storing Your API Credentials

1. Immediately copy the API key, secret, and passphrase into a secure password manager or encrypted file. KuCoin will not show these values again after this point, and losing them means creating a new key.

2. Never share your API credentials via email, messaging apps, or untrusted platforms. Treat them like your login password and 2FA codes.

3. Restrict IP binding if your use case allows it. Within the API settings, specify trusted IP addresses that can access the account using this key, reducing the risk of unauthorized access.

4. Regularly review active API keys and deactivate any that are no longer in use. Expired or unused keys pose unnecessary security risks.

Testing and Integrating the API Key

1. Use a sandbox environment or testnet (if supported) to validate the API connection before deploying with real funds.

2. Integrate the API key into your application by configuring the headers with the proper authentication method—typically HMAC-SHA256 signing using the API secret and passphrase.

3. Make a simple request such as fetching account balance or market data to confirm connectivity and correct permissions.

4. Monitor the API usage logs in your KuCoin account to ensure requests are being made as expected and detect any anomalies.

Frequently Asked Questions

Can I recover my API secret if I lose it?No, KuCoin does not store your API secret after creation. If you lose it, you must generate a new API key and update all associated applications.

How many API keys can I create on KuCoin?KuCoin allows users to create up to five API keys per account. You can manage their status—active, frozen, or deleted—from the API management section.

What should I do if I suspect my API key has been compromised?Immediately go to the API management page and delete the suspected key. Then create a new one with appropriate permissions and update your services accordingly.

Does KuCoin support IP whitelisting for API keys?Yes, during or after creation, you can bind an API key to specific IP addresses. Only requests originating from those IPs will be accepted, enhancing security significantly.