Crypto Exchange API: What It Does and What Your Key Can Do

A crypto exchange API is the machine-readable door into an exchange. Instead of clicking a chart, your code sends an HTTP request and the exchange sends back a price, a balance, or an order confirmation. That much every explainer covers. The part beginners skip — and the part that costs people money — is permissions. An API key is not a password with one setting. It is a scoped credential, and the boxes you tick when you create it decide exactly what someone could do with it if it leaks.

This guide covers what a crypto exchange API is used for, how a request proves it came from you, what each permission scope actually allows, and the rate limits that break most first integrations.

What a Crypto Exchange API Actually Does

An exchange API exposes two families of endpoints. Public endpoints need no authentication and return market data — ticker prices, candlesticks, order book depth, server time, the list of tradable symbols. Private endpoints require a signed request and touch your account: place and cancel orders, read balances and positions, pull fills and ledger records.

Those endpoints arrive over two transports, and mature systems use both. REST is request-and-response, one action at a time — place or cancel an order, check a balance, pull historical candles. WebSocket is a persistent stream, used for live order book diffs, trades, and fill notifications where polling would be too slow and too expensive.

The practical uses follow: trading bots, market-making and quant strategies, portfolio trackers, tax tools that reconcile every fill, and dashboards that measure your own slippage rather than trusting the exchange's chart.

How an API Call Proves It Is You

Creating a key on WEEX produces three values, and they do different jobs:

• APIKey — the public identifier that tells the exchange which key is calling.
• SecretKey — the signing secret. It is never sent over the wire.
• Passphrase — a phrase you choose. It cannot be recovered or changed; lose it and you create a new key.

Every private request is signed. WEEX generates the ACCESS-SIGN header by running HMAC SHA256 over timestamp + METHOD + requestPath + "?" + queryString + body, then Base64-encoding the result. A depth request signs a string like 1591089508404GET/api/v3/market/depth?symbol=BTCUSDT&limit=20.

Two things fall out of that design: the secret never travels, so intercepting a request does not hand over the key, and because the timestamp is inside the signed string, a captured request cannot be replayed against a different payload later. The full scheme is in the WEEX API signature documentation.

What Read, Spot and Futures Permissions Actually Allow

This is where the security conversation should start, not end. Scopes on WEEX are independent — checking one does not imply another, and new keys default to read-only.

Source: WEEX futures API FAQ, last updated 2026-04-14, and the WEEX API key preparation guide, both checked 28 July 2026.

Note what is missing from that table: a withdrawal scope. WEEX's documented API key permissions cover reading and trading only, so a key on its own is not a route for moving coins off the account. Some venues do offer withdrawal-enabled keys — if you use one, that is the single highest-risk setting in your entire stack and it should almost never be on for a bot.

Is Crypto Exchange API Trading Safe?

Reasonably, if you treat the key as a live credential rather than a config string. The API is not the weak point; key handling is. Keys leak from committed .env files, screenshots in support chats, and third-party "trading dashboards" that ask for trade permission when read-only would do the job.

Three settings do most of the work. Grant the narrowest scope the tool actually needs — a tax tool never needs to trade. Bind the key to an IP address; WEEX warns explicitly that keys with no IP binding pose a security risk, and an IP-bound key is close to useless to someone who steals it from another network. Keep development and production keys separate so you can delete one without taking the other down.

What traders usually miss: a trade-only key cannot drain your account by withdrawing, but it can still destroy it. An attacker with futures permission can open a maximum-leverage position into an illiquid pair and let liquidation do the damage. Scope limits the blast radius; it does not remove it. Position and leverage caps in your own code are the second line of defence.

Creating an API Key on WEEX and the Limits That Bite First

Keys are created in account settings, not through the API. Each account can hold up to 10 API key groups, so there is no reason to reuse one across projects. Then read the limits before you write the retry logic, because these are what break a first integration:

Source: WEEX futures API access restrictions and FAQ, last updated 2026-04-14, checked 28 July 2026.

Three more traps worth naming. Error -1052 (insufficient permissions) usually means the Futures box was never ticked, not that your signature is wrong. A WebSocket connection returns 403 if the request header carries no User-Agent. And the passphrase must be alphanumeric — special characters will fail authentication in ways that look like a signing bug.

Before risking capital, WEEX exposes paper-trading endpoints under /capi/v3/sim/ — balance, positions, order placement and order history — which let you debug order flow without real funds. Use them until your error handling and reconciliation are boring.

The Short Version

A crypto exchange API is not an advanced-trader feature; it is a permission system with a trading interface attached. Get the scope right, bind the IP, keep the passphrase somewhere you will not lose it, and the rest is ordinary engineering. Ready to build? Create a key from WEEX API, start on the simulation endpoints, and move to live size only when your logs are clean. If you want a broader look at how WEEX's REST and WebSocket stack fits together, see does WEEX support API trading.

FAQ

1. What is a crypto exchange API used for?

Reading market data and controlling an account through code rather than the web interface — automated trading, portfolio tracking, tax reconciliation, and custom analytics on your own fills and slippage.

2. Is API trading legal?

Programmatic trading is a standard, exchange-supported feature and is legal in most jurisdictions. What matters is your local regulatory status and the exchange's own terms — market manipulation is illegal whether you do it by hand or by script.

3. Can someone withdraw my funds with a stolen API key?

Not on WEEX, whose documented key scopes as of April 2026 cover reading and trading only. On exchanges that do offer withdrawal-enabled keys, a stolen key with that scope can move funds — which is why it should stay off.

4. Why does my new API key return an error immediately?

Newly created or modified keys take roughly 15 minutes to propagate. If it still fails after that, check the permission checkbox before you debug the signature.

5. Do I need to code to use an exchange API?

To build a strategy, yes. To connect an existing tracker or tax tool, no — you paste a read-only key into it. Never give such a tool trade permission.

Risk Warning

Crypto assets are highly volatile and trading them can result in partial or total loss of capital. API trading adds risks that manual trading does not: a coding error can submit hundreds of unintended orders before you notice, a rate-limit rejection can leave a position unhedged, and a leaked key with trade permission can be used to open leveraged positions in your account even when withdrawals are impossible. Futures trading amplifies all of this — leverage can liquidate a position on a move that a spot holder would sit through. Test on simulation endpoints, grant the narrowest permission that works, bind keys to an IP, and never trade with capital you cannot afford to lose.