API keys are created on the Bitaroo website at trade.bitaroo.com.au, under Account → API. Before you start, check that you meet the requirements in API Keys Eligibility.
How do I generate an API key?
- Sign in and go to Account → API.
- Select Generate new API key.
- Enter a Name. The name is only for your own reference, so choose something that tells you where the key is used, for example Tax reporting or Trading bot.
- Choose an Access Level, either Read-Only or Full Access. The two are explained below.
- Enter the 6-digit code from your authentication app.
- Select Confirm.
Your new key is then displayed. Copy it and store it somewhere safe before you close that window, because the secret half of the key is shown only once. See Understanding Key Format.
What is the difference between Read-Only and Full Access?
Both access levels can read your account. That covers:
- Your account balances
- Your open orders and order history
- Your trade history
- Your deposit and withdrawal history
- Market data, such as the order book and recent market trades
Full Access adds trading. A Full Access key can place new orders and cancel existing ones.
Read-Only cannot trade. An attempt to place or cancel an order with a Read-Only key is rejected.
Withdrawals are not available through the standard API, so neither access level can move funds off your account.
Which access level should I choose?
Choose Read-Only whenever the program only needs to look at your account. Portfolio trackers, tax and accounting tools, dashboards and reporting scripts all work perfectly well with a Read-Only key, and a Read-Only key that is exposed cannot be used to trade. This is the safer choice, so use it wherever it is enough.
Choose Full Access when the program needs to place or cancel orders for you, such as your own trading bot.
Can I change the access level later?
The access level is fixed when the key is created. To move a program from one level to the other, generate a second key at the level you want, switch the program over to it, then delete the first key. Each key shows its level in the Permissions column on the API screen.
Why can I not see the form?
The form appears once your account meets every requirement in API Keys Eligibility. The screen tells you which step is outstanding, whether that is the video, an authentication app, or a review still in progress. Two other reasons are worth knowing about:
- You already hold 5 active keys, which is the maximum. Delete one you no longer use.
- You changed or reset your password in the last 24 hours. API key management is paused for 24 hours afterwards as a security measure.
Once your key exists, keeping it safe is the next step. See Managing and securing your API keys.