This article covers looking after your API keys once they exist: how many you can hold, how to remove one, and what to do if a key is exposed. To create a key, see Generate API Key. Keys are managed on the Bitaroo website under Account → API.
How many API keys can I have?
Up to 5 active keys at a time. If you have reached the limit, delete a key you no longer use to free a slot. Giving each tool its own key is worth the effort, because you can then remove one without disturbing anything else you have connected.
How do I change the access level of a key?
The access level is fixed when the key is created, so a key cannot be switched between Read-Only and Full Access. Generate a new key at the level you want, move the program across to it, then delete the old key.
How do I delete an API key?
- Go to Account → API.
- Find the key by its name or its Key ID.
- Select the delete icon at the end of that row and confirm.
Deletion takes effect immediately, and any program still using that key will stop being able to reach the API. A deleted key cannot be restored, so generate a replacement if you still need one.
What should I do if my API key is exposed?
- Delete the key straight away.
- Generate a replacement and update the program that was using the old key.
- Review your open orders and your trade history for anything you did not authorise.
- Contact support if anything looks wrong.
Withdrawals are not available through the standard API, so an exposed key cannot be used to move funds off your account. A Full Access key can still place and cancel orders, so treat the secret with the same care as your password. A Read-Only key cannot trade at all.
How do I keep my API keys safe?
- Choose Read-Only unless the program genuinely needs to trade.
- Give each tool its own key, named so you can tell which is which.
- Keep the secret in a password manager or a secrets file. Avoid shared documents, screenshots, chat messages and any source code you publish.
- Delete keys you have stopped using.
- Bitaroo will never ask you for an API key or its secret. Nobody at Bitaroo needs it, and we cannot read it.
Why is API key management unavailable?
After you change or reset your password, API key management is paused for 24 hours as a security measure, and the API screen shows a notice in place of your keys. Keys that already exist keep working during that time. If you believe a key has been exposed while the pause is in place, contact support straight away so we can secure your account.
What happens to my keys if my account is restricted?
If an account is blocked, every API key on it is revoked and any open orders are cancelled.
What happens if I send too many requests?
The API is rate limited by IP address. If requests arrive faster than the limit allows, the API answers with HTTP status 429 and the label limit-reached. Slow the program down and try again.