Trading on Binance with code starts with an API key, but the details that actually trip people up come after that: which key type to pick, why trading permission will not switch on, whether rate limits count per IP or per account, and how the testnet differs from demo trading. This guide follows Binance's official API documentation and help center, with figures as of 2026-09-28; the official pages always prevail. The strategy side of fee rebates (net expectancy, break-even) is already covered in fee rebates for quant traders; this article is only about wiring your code to Binance. Bind NOVA888 through Quant Nova before your strategy goes live: new users get a 30% rebate from Lv.1 with no threshold, 1.5 times a typical 20% referral code.
Before you create a key: three prerequisites
Binance's help article "How to Create API Keys on Binance?" lists three things you must do first, otherwise the Create API button goes nowhere:
- Enable two-factor authentication (2FA).
- Deposit any amount into your Spot Wallet to activate the account.
- Complete identity verification. KYC levels are compared in our KYC comparison.
No Binance account yet? See the Binance registration guide. Enter the referral code at sign-up so your later trading fees are counted toward rebates (whether API orders count is covered in the rebate section below).
Which key type: system-generated HMAC or self-generated Ed25519/RSA
The first choice when creating a key is its type. Binance's API docs are blunt about it:
| Type | How it is made | Binance's verdict | Watch out for |
|---|---|---|---|
| Ed25519 (self-generated) | You create the key pair locally and give Binance only the public key | Recommended; best performance and security | WebSocket API session.logon supports Ed25519 only |
| RSA (self-generated) | Same idea; 2048 and 4096-bit keys supported | More secure than HMAC | Large signatures can hurt performance |
| HMAC (system-generated) | Binance issues an API Key and a Secret Key | Marked deprecated; migration recommended | Shared secret: if it leaks, anyone can sign with it |
The difference: an HMAC Secret Key is generated by Binance and held by both sides, while an Ed25519 or RSA private key never leaves your machine and Binance stores only the public key. Pick Ed25519 for any new key and you no longer have to trade off IP restrictions against trading permission, as the next section explains.
Creating the key (web and app)
Web: log in, click the profile icon, then [Account] → [API Management] → [Create API] → choose the key type → enter a label → verify with your 2FA device or passkey → done.
App: switch to Binance Pro → [More] → the [Other] section of the Services panel → [API Management] → [Create API], then the same steps.
For a self-generated key, create the key pair with third-party software first and paste the public key into Binance. Never upload the private key file or send it to anyone.
Permissions: read, trade, withdraw, and the IP whitelist
Binance API permissions are ticked one by one. The API docs state that a new key cannot trade by default; you enable trading on the API Management page. They also suggest splitting duties, for example one key with trade permission for orders and a separate read-only key for monitoring order status.
| Situation | Official rule (as of 2026-09-28) |
|---|---|
| System-generated (HMAC) key without IP restriction | Read only. In effect since 2023-01-30 |
| You want trading or other permissions | One of three: add an IP access restriction (IPv4), use a self-generated key (Ed25519/RSA), or disable the default security controls |
| You want withdrawal permission | An IP access restriction (IPv4) is mandatory |
| Futures permission cannot be enabled | The key was created before the Futures account was opened, or Portfolio Margin is active |
The last row is common: create a key first, open a Futures account later, and that old key can never get Futures permission. Create a new one.
On withdrawal permission the advice is one line: do not enable it. A quant strategy needs only read and trade; move funds by hand on the website or app. A key without withdrawal permission and locked to an IP whitelist cannot be used to take your coins, even if it leaks. Binance itself says it strongly recommends against enabling anything beyond read until proper IP restrictions are in place.
Binance does list "disable the default security controls" as an option, but that simply removes the protection. Unless you know exactly what you are doing, Ed25519 plus an IP whitelist is the right path.
Rate limits: weight counts per IP, orders count per account
Binance has three limiters: request weight (REQUEST_WEIGHT), orders (ORDERS) and raw requests (RAW_REQUESTS). The exact caps are whatever exchangeInfo returns in rateLimits; the table below is what the official endpoints returned on 2026-09-28:
| Market | Request weight | Orders | Other |
|---|---|---|---|
| Spot (api.binance.com) | 6,000 per minute | 100 per 10 seconds; 200,000 per day | Raw requests 300,000 per 5 minutes |
| USDⓈ-M futures (fapi.binance.com) | 2,400 per minute | 1,200 per minute; 300 per 10 seconds | — |
Rules worth remembering while you code:
- Weight is tracked per IP, not per key. Several keys on one server share the same weight budget. Every response carries an
X-MBX-USED-WEIGHT-1Mheader so you can monitor it. - Endpoints have different weights. A spot order (
POST /api/v3/order) weighs 1, while account information (GET /api/v3/account) and commission rates (GET /api/v3/account/commission) weigh 20 each. Polling balances is the classic weight killer; the User Data Stream saves a lot. - Order limits count per account and only unfilled orders count. Binance's Spot Unfilled Order Count Rules say partially or fully filled orders do not count, so as long as your orders trade you can keep placing them. Strategies that post and cancel heavily hit the cap first.
- Penalties escalate. First you get HTTP 429; keep sending after 429s and the IP is auto-banned with 418, with bans scaling from 2 minutes to 3 days for repeat offenders. The
Retry-Afterheader tells you how many seconds to wait. - Timing window. Signed requests need a
timestamp;recvWindowdefaults to 5,000 ms with a 60,000 ms maximum, and Binance recommends 5,000 or less.
The futures docs likewise state that order rate limits are counted per account, weight is counted per IP, and the 429/418 ban mechanism is the same as spot.
REST, WebSocket API and WebSocket streams: what each is for
| Channel | Use | Official limits |
|---|---|---|
| REST API | Place and cancel orders, query account and history | Weight and order limits above |
| WebSocket API (ws-api.binance.com) | Place orders and query over a persistent connection, without reconnecting each time | Connecting costs 2 weight; weight is per IP and shared by all connections from it; a connection is valid for 24 hours |
| WebSocket market streams (stream.binance.com) | Real-time prices, depth and trades | 5 incoming messages per second per connection (ping, pong and subscribe commands all count); up to 1,024 streams per connection; 300 connections per 5 minutes per IP; disconnected after 24 hours |
The stream server sends a ping every 20 seconds and drops the connection if no pong arrives within a minute. In practice: receive market data from streams, place orders via REST or the WebSocket API, and never poll prices over REST in a loop. For market data only, Binance also offers data-api.binance.vision and data-stream.binance.vision, which need no key.
Test first: Spot Testnet versus Demo Mode
Binance has two environments you can practise on via API, and its docs compare them directly:
| Item | Spot Testnet | Demo Mode |
|---|---|---|
| Access | Generate a separate key at testnet.binance.vision | Log in to Demo Trading with your Binance account and create a key on its API Management page |
| REST URL | testnet.binance.vision/api | demo-api.binance.com/api |
| Balances | Reset roughly once a month, without notice | Reset whenever you like from the UI |
| Prices and order books | Independent of the live exchange | Similar to the live exchange |
| Features | Sometimes gets new features before the live exchange | Same as the live exchange |
| Limits and filters | Generally the same | Exactly the same |
Binance's own summary: use the testnet to integrate upcoming features, and Demo Mode to test against realistic market data. A few more details: the testnet only exposes /api endpoints, not /sapi; testnet assets are virtual and cannot be moved in or out; the USDⓈ-M futures test environment lives at demo-fapi.binance.com. Demo Trading does not support spot trading bots or copy trading, nor futures TWAP, grid and some other tools, and customer support cannot see demo orders.
Binance also warns that realistic market data is not real market data: a strategy that makes money in Demo Mode will not necessarily make money live, because slippage and fill order can differ.
Code sample: query your own fee rates with Ed25519
The sample shows the signing flow: build the query string, sign it with your private key, Base64-encode the result and attach it as the signature parameter. It calls GET /api/v3/account/commission, which only needs read permission. Keys come from environment variables and a local file; never hard-code them or commit them to Git.
import base64, os, time, urllib.parse
import requests
from cryptography.hazmat.primitives.serialization import load_pem_private_key
API_KEY = os.environ["BINANCE_API_KEY"]
with open(os.environ["BINANCE_PRIVATE_KEY_PATH"], "rb") as f:
private_key = load_pem_private_key(f.read(), password=None)
params = {"symbol": "BTCUSDT", "timestamp": int(time.time() * 1000)}
payload = urllib.parse.urlencode(params)
params["signature"] = base64.b64encode(private_key.sign(payload.encode("ascii"))).decode()
BASE = "https://api.binance.com" # testnet: https://testnet.binance.vision
r = requests.get(BASE + "/api/v3/account/commission",
params=params, headers={"X-MBX-APIKEY": API_KEY}, timeout=10)
print(r.status_code, r.json())standardCommission in the response is your standard maker/taker rate for that pair, and discount shows the reduction when paying fees in BNB. Once it works, switch to the live exchange and only then enable trading.
API order fees: same as the app? How to stay maker
Binance's futures fee page says maker and taker fees "vary depending on your VIP level", and the fee schedule is split only by VIP level, with no separate API rate. Regular-user rates are 0.1%/0.1% for spot and 0.02% maker / 0.05% taker for USDⓈ-M futures (verified 2026-09-24); every VIP tier is in Binance VIP fee tiers.
Maker or taker depends on whether your order matches immediately when it arrives: the part that fills at once is taker, the part that rests on the book is maker (see maker and taker fees explained). To guarantee maker-only on spot, use the LIMIT_MAKER order type, which Binance defines as a limit order that is rejected if it would immediately trade as a taker, in other words post-only.
Do API trades earn rebates? What the official terms say
We checked Binance's Referral Pro FAQ and its Affiliate Program guide. As of 2026-09-28 they say the referrer earns commission from the trading fees paid by the referred user on spot, margin and futures. Binance does not state separately whether API orders are included or excluded, and does not distinguish by order channel, so whether API orders count is shown in your Quant Nova daily settlement records. What Binance does spell out, and what matters to algorithmic traders:
- No fee, no commission: "no commission will be generated from your referrals' trading with no trading fee." Zero-fee pairs and fully offset fees produce no rebate.
- Sub-account fees go to the master account's referrer: sub-accounts cannot invite users, but their trading commissions are credited to the master account's referrer. If your strategies run in sub-accounts under a master account registered with NOVA888, whether that shows up in your Quant Nova rebate is confirmed by your settlement records.
- Commission is based on net fees after market maker rebates: from 2026-04-29 for spot and 2026-07-15 for futures, referral commissions are distributed on net fees after deducting applicable market maker rebates. Accounts in a market maker programme with negative maker fees should keep this in mind.
Binding NOVA888 (a Binance affiliate code) through Quant Nova gives new users 30% from Lv.1 with no threshold (20% automatic from the exchange + 10% extra from Quant Nova), 35% at SVIP reached through trading volume, and up to 40% at invitation-only Supernova, twice a typical 20% code. Binding needs only your UID; you never hand an API key to anyone. Full tiers and volume examples are in the Binance fee rebate guide, the code and sign-up link in Binance referral code NOVA888, and for an existing account start with the Binance rebind guide. Quant teams that are already VIP elsewhere or trade large volume are welcome to contact Quant Nova support; we work directly with the exchange's official team to seek benefits such as VIP tier trials for you (final terms are set by the exchange).
Security: leaked keys, third-party bots and managed-account scams
Binance's API docs put it plainly: "Both API key and secret key are sensitive. Never share them with anyone." If you notice unusual activity, immediately revoke all keys and contact Binance support. In practice:
- One key per job: separate keys for trading, monitoring and reporting, so a leak means revoking only one.
- Lock every key to an IP whitelist, update it when your server IP changes, and delete keys you no longer use.
- For third-party bots or tools, grant only what they need (usually read plus trade) and bind the server IPs they publish. If a service asks for withdrawal permission, do not connect it.
- Never paste keys into chat groups, screenshots, cloud notes or public code repositories.
The most common scam is "managed trading": someone claiming to be a trader or quant team promises a fixed monthly return and asks you to create a key for them. On Binance, withdrawal permission can only be ticked after the key is restricted to whitelisted IPs, so if someone asks you to whitelist their IP and then enable withdrawals, they are preparing to move your funds out: refuse; even with trade permission alone, they can wipe out your margin with high leverage or self-matched trades.
When Taiwan's Financial Supervisory Commission published its VASP registration list on 2025-09-22, it warned that scammers lure people into buying virtual assets with lines such as "guaranteed profit, no loss" and "high return, low risk", then demand unfreezing fees, deposits or taxes before any payout can be withdrawn. (FSC press release, Chinese)
For users in Taiwan: as of 2026-09-28 Binance is not on the FSC list of virtual asset service providers that have completed AML registration. How to check the list and the status of each exchange is covered in Taiwan FSC VASP registration list.
FAQ
Why can my Binance API key only be set to read?
Because it is a system-generated (HMAC) key without an IP restriction. Since 2023-01-30 such keys are read-only; add an IPv4 whitelist or create a self-generated Ed25519/RSA key to enable trading.
Do I have to bind an IP to my API key?
It is mandatory for withdrawal permission. For trading, an HMAC key needs an IP restriction (unless you disable the default security controls, which is not advisable), while Ed25519/RSA keys do not. Binance strongly recommends IP restrictions on every key that is not read-only.
What are Binance's API rate limits?
As of 2026-09-28: spot 6,000 weight per minute, 100 orders per 10 seconds and 200,000 per day; USDⓈ-M futures 2,400 weight per minute, 1,200 orders per minute and 300 per 10 seconds. Weight counts per IP, orders per account; exchangeInfo is authoritative.
Should I use the testnet or Demo Mode?
Use the testnet (testnet.binance.vision) to integrate new features, and Demo Mode (demo-api.binance.com) to test strategies on realistic market data; its limits and filters are exactly the same as live.
Are API order fees higher or lower than in the app?
Binance lists fees only by VIP level, with no separate API rate. Use GET /api/v3/account/commission to see your actual rate for each pair.
Can API trading earn fee rebates?
Binance's referral terms pay commission on trading fees paid by the referred user and do not separately say whether API orders are included or excluded, so rely on your settlement records. Sub-account fees go to the master account's referrer; trades with no fee generate no commission.
Telegram · @quant_nova
LINE · @238pqnkj