Exchange API key

The key is a second door into the same account, opened by a token and a signature rather than a login screen. Bitstamp's Terms of Use, last updated May 30, 2025, put every loss under a key you generated on you, including unauthorized access and loss of funds. Grant read-only scope, never withdrawal, and delete keys you no longer use.

How it works

An exchange API key arrives as a pair: a public identifier naming the account, and a secret the caller signs every request with. The secret appears once, at creation, and the exchange keeps its own copy to check every signature. From then on a program can place orders, pull balances or move funds by signing a request, with no browser, no password prompt and no second factor in the path.

The permissions are the whole product. Bitstamp's terms put it in one line: "The scope of access you permit by such API key is defined by you when you create API Key", and point at the account's access control page. Venues split that scope into reading, trading and withdrawing, and many let a key be pinned to fixed IP addresses, so a stolen secret is useless elsewhere. A read-only key handed to a tracker cannot lose you money. A key carrying withdrawal permission is a standing instruction to pay whoever holds the secret.

Contractually, a request signed by your key is your order. Bitstamp UK Limited's Terms, version dated 01 July 2026, define an Instruction as any order or instruction received from you, and the API clause disclaims liability for losses "resulting from use or Instructions submitted through API Keys". The same clause runs in six of the group's entity terms, covering Bitstamp Limited, Bitstamp Europe S.A., Bitstamp USA Inc., Bitstamp UK Limited, Bitstamp Global Ltd and Bitstamp Asia Pte. Ltd. Bitstamp also reserves the right to suspend any key without prior notice where it believes security has been compromised.

Where you see it

Exchange API keys sit in the security settings of every venue that publishes a trading interface, usually under a heading like access control. You create one to connect a portfolio tracker, a tax tool, a recurring-buy script or a spreadsheet pulling your trade history. A venue may also let an outside application request a key on your behalf: Bitstamp calls that Bitstamp Connect, and requires your consent inside your account before an integrator's connection is established.

Two habits cover most of the risk. Match the scope to the job, since a tax tool reading your fill history has no reason to hold trade or withdrawal rights, and revoke a key the moment its tool is retired, because nothing about a key expires on its own. If your venue supports IP allowlisting, use it. If you think a secret has leaked, delete the key first and investigate afterwards.

One catch surprises people building their own tooling. Bitstamp's UK terms license the market data a key returns for Permitted Market Data Use only, which covers viewing prices, submitting orders, reconciling your transactions and meeting tax or audit obligations. Republishing those prices, merging them with other venues' feeds, or training a model on them counts as Commercial Market Data Use and needs a separate market data agreement.

Exchange API key vs private key

A private key controls bitcoin on the blockchain; an exchange API key controls an account at a company. The difference shows up when either one leaks. A compromised API key is revocable: delete it, and the venue stops honoring signatures made with it. A compromised private key cannot be revoked by anybody, because the network has no idea who should hold it, and the only defense is moving the coins to a fresh key before the thief does. That asymmetry also caps what a leaked API key can cost you: it reaches the balance the exchange holds for you and nothing you have already withdrawn.