Bybit API Setup 2026: Key Permissions, IP, Rate Limits, Demo

Before a program can trade on Bybit you need three things in place: an API key with only the permissions it needs, a request pattern that stays inside the rate limits, and a test environment where mistakes cost nothing. This guide is based on Bybit's official V5 API documentation and Help Center, verified on 2026-09-28: where to create the key, which permissions to tick, why to bind an IP, when a key without an IP expires, the REST and WebSocket limits, Demo Trading versus Testnet, and finally what the official terms say about fees and rebates on API orders. Bind Bybit to Quant Nova with referral code NOVA888 and new users get a 30% fee rebate at Lv.1, 1.5 times the common 20% referral code, so part of the fee on every fill your strategy makes can come back to you.

Quick answers

• API keys can only be created on the website, not in the app; brand-new accounts may be blocked from creating one for the first 48 hours.
• Permissions are read-only or read-write: a futures strategy needs Contract Trade (orders, positions), a spot strategy needs Spot Trade. The Withdraw permission under Wallet (master account only) is never needed to run a strategy, so leave it unticked.
• A key with no IP bound expires after 90 days; after you change the account password, keys with no IP bound stop working 7 days later.
• Two layers of rate limits: 600 HTTP requests per 5 seconds per IP (exceed it and you are blocked for 10 minutes), plus per-UID, per-second limits for each endpoint: 10 orders/s on USDT perpetuals and 20 orders/s on spot.
• Start on Demo Trading: it mirrors mainnet prices, comes with 50,000 USDT and other simulated assets, and uses api-demo.bybit.com.
• Rebates: Bybit's Pro fee tiers do not apply to affiliate and referral users, so bound API users pay their VIP-level fees; the terms do not mention API orders separately, so whether they count is determined by the settlement records. Binding a rebate only needs your UID, never an API key.

Before you start: four official restrictions

• Website only: the Help Center states that API keys can only be created and deleted on the website, with no option in the app (How to Create Your API Key, How to Delete Your API Key).
• 48 hours for new accounts: new users may be restricted from creating API keys for the first 48 hours after registration for risk control. Bybit's example: register at 10:00 UTC on 12 May and you can create a key from 10:00 UTC on 14 May.
• US and Mainland China IPs are rejected: the integration guide says requests from IPs located in the US or Mainland China return 403 Forbidden (Integration Guidance). Pick your server region accordingly.
• Regional sites use their own domains: international accounts use api.bybit.com or api.bytick.com; accounts registered on the Turkey, Kazakhstan, Georgia, UAE, EEA, Indonesia, Japan or Hong Kong sites must use their own API domains.

Decide on the key type too. Bybit offers system-generated keys (HMAC), where Bybit issues the key and secret, and self-generated keys (RSA), where you create a key pair on your own machine with Bybit's RSA key generator (2048 or 4096 bits) and give Bybit only the public key, so the private key never leaves your computer (official RSA guide). Either way, Bybit's advice is the same: treat the keys like passwords.

Creating the key and choosing permissions

1. Log in on the Bybit website, click the profile icon at the top right and choose API to open API Management (or go straight to bybit.com/app/user/api-management).
2. Click Create New Key.
3. Choose system-generated or self-generated, add a name, then set read/write, the functions to allow and the IPs to bind.
4. Enter your Google Authenticator code and submit.

Save the secret the moment it is shown: the API documentation states the secret cannot be queried again through the API. The permission groups listed in the official API docs:

Sources: Get API Key Information, Modify Master API Key. Subaccounts can have their own keys, created by the master account's key through an official endpoint with the same per-permission choices. One strategy per subaccount keeps limits and risk separate.

Withdraw is the most dangerous permission a key can have. Leave it off and a leaked key cannot be used to move your assets out; the same logic applies to transfer permissions you do not need.

IP binding and key expiry

When creating a key you can list the IPs allowed to call it, separated by commas; leaving it empty or entering * means no binding. The official docs state two expiry rules (Create Sub UID API Key):

• A key with no IP bound becomes invalid after 90 days.
• Once the account password is changed, keys with no IP bound become invalid after 7 days.

The key information endpoint returns deadlineDay (days remaining) and expiredAt (expiry date), which Bybit says apply only to keys with no IP bound or where the password has been changed. In practice: run the strategy on a cloud server with a fixed outbound IP and bind that IP; if you run it on a home connection with a changing IP, plan to recreate the key regularly. If every request suddenly fails authentication, check whether the key has expired before debugging your code.

Rate limits: the IP layer and the UID layer

Bybit applies two layers of limits (Rate Limit Rules, verified 2026-09-28):

• IP layer: by default each IP may send 600 HTTP requests in a 5-second window, across api.bybit.com and regional domains. Exceed it and you get "403, access too frequent"; Bybit says to close all HTTP sessions and wait at least 10 minutes, after which the ban lifts automatically. It also advises against running at the edge of the limit.
• UID layer: a rolling per-second window per UID, with a separate allowance for each endpoint. Exceed it and you get retCode 10006, "Too many visits!". Every response carries X-Bapi-Limit (current limit), X-Bapi-Limit-Status (remaining) and X-Bapi-Limit-Reset-Timestamp (reset time), so your code can slow itself down.

Because allowances sit on the UID, several programs under one UID share the same endpoint allowance; if you run many strategies, splitting them across subaccounts keeps them from throttling each other. Common endpoints (Unified Trading Account):

Details that are easy to miss:

• Batch endpoints have their own allowance: batch and single-order endpoints do not share limits; each batch holds 1 to 10 orders and consumes one unit per order (a batch of 5 uses 5). Orders beyond the remaining allowance in that second fail, the rest go through.
• Open order caps: perpetuals and futures allow 500 active orders and 10 conditional orders per symbol; spot allows 500 orders in total per account, including up to 30 open TP/SL orders and 30 conditional orders per symbol; options default to 50 open orders per coin (Place Order).
• Daily order totals are monitored: if the total orders across a master account and its subaccounts in one UTC day exceed a certain limit, Bybit reserves the right to remind, warn and restrict, and API users accept this by default.
• Limits can be raised: order endpoints are marked upgradable; contact your client manager or submit an application.
• Keep your clock accurate: recv_window defaults to 5,000 ms and the timestamp must fall between server time minus recv_window and server time plus 1 second; Bybit recommends keeping the host NTP-synchronised.

WebSocket: market data, private streams and WS orders

Bybit's WebSocket has three parts: public market data (separate URLs for spot, USDT/USDC contracts, inverse and options), the private stream (/v5/private for orders, executions, positions and wallet), and WS order entry (/v5/trade, which does not support spread trading or Demo Trading). The connection rules (WebSocket Connect):

• Do not open more than 500 connections within 5 minutes per domain, and do not connect and disconnect frequently.
• Up to 1,000 market data connections per IP, counted separately for spot, linear, inverse and options.
• Send a ping every 20 seconds; with no ping and no data the connection is cut after 10 minutes. Private and order-entry connections can set max_active_time between 30 seconds and 10 minutes.
• Spot allows up to 10 args per subscription request, and one public connection cannot exceed 21,000 characters of args.

A common pattern is to receive prices and order status over WebSocket and keep REST for placing orders and periodic reconciliation, so polling does not eat your REST allowance.

Test on Demo Trading or Testnet first

Bybit has two test environments, and its FAQ spells out the differences (FAQ — Demo Trading, Testnet test coins, Demo Trading API):

The rule of thumb: to see how a strategy reacts to real prices, use Demo Trading; to test non-trading features such as transfers, Bybit points you to Testnet. Two things to remember: demo keys are created separately inside Demo Trading, and they must connect to api-demo.bybit.com, not mainnet; the demo WebSocket only carries private streams (wss://stream-demo.bybit.com), so public data comes from mainnet's stream.bybit.com. Bybit also warns never to deposit real funds to a Testnet account, as they cannot be recovered.

A minimal example that reads the unified account balance with a demo key. Per the docs, a GET request signs timestamp + API key + recv_window + query string with HMAC-SHA256, output as lowercase hex. Keys come from environment variables, never hard-coded:

import hashlib, hmac, os, time, requests

API_KEY = os.environ["BYBIT_DEMO_KEY"]        # demo key, read-only is enough
API_SECRET = os.environ["BYBIT_DEMO_SECRET"]
BASE = "https://api-demo.bybit.com"
RECV_WINDOW = "5000"

query = "accountType=UNIFIED"
ts = str(int(time.time() * 1000))
payload = ts + API_KEY + RECV_WINDOW + query
sign = hmac.new(API_SECRET.encode(), payload.encode(), hashlib.sha256).hexdigest()

r = requests.get(f"{BASE}/v5/account/wallet-balance?{query}", headers={
    "X-BAPI-API-KEY": API_KEY,
    "X-BAPI-TIMESTAMP": ts,
    "X-BAPI-RECV-WINDOW": RECV_WINDOW,
    "X-BAPI-SIGN": sign,
})
print(r.json()["retCode"], r.headers.get("X-Bapi-Limit-Status"))

Once it works, switch the domain to api.bybit.com and use a mainnet key. Demo accounts can also be topped up through the API (/v5/account/demo-apply-money, once per minute).

Fees and rebates on API orders

Fees: Bybit's fee schedule is set by VIP level and does not list a separate API rate. VIP0 is 0.02% maker / 0.055% taker on contracts and 0.1% / 0.1% on spot. A separate Pro1 to Pro6 schedule requires, on top of volume, that API trading exceed 20% of volume; but the VIP rules state "The Pro status does not apply to Affiliate and Referral users, even if their API trading volume exceeds 20%", so users bound through a referral code pay their VIP-level fees even if they trade mainly by API. Full thresholds are in Bybit VIP levels and Pro tiers. Check your actual rate with /v5/account/fee-rate.

Rebates: Bybit's Affiliate Program FAQ (official text, updated 2026-09-19) says the commission base is trading fees minus market maker rebates minus bonuses and coupons, and that users who receive a rebate, discount or incentive under another Bybit program may not contribute to affiliate commission. The terms do not exclude API orders, but they do not mention them either, so whether API-generated fees count is determined by the settlement records; accounts in Bybit's market maker program should check first. The same FAQ says the referral relationship may be terminated if a referred user makes no trades for 180 consecutive days, which matters for strategies that sit idle for months.

Quant Nova's Bybit rebate is 30% at Lv.1 for new users, 35% at SVIP (reachable by volume), and up to 40% at the invite-only Supernova level. At a typical quant size: 5 million USDT of monthly futures volume, all taker, is about 2,750 USDT in fees, which reaches Lv.5 (2,500 USDT of fees in 30 days) at 34%, or about 935 USDT back each month; a common 20% code returns 550 USDT. See the Bybit fee rebate guide, adding a referral code within 14 days of sign-up, and fee rebates for quant traders.

If you are already a VIP on another exchange or trade large volume, contact Quant Nova support: we work directly with the exchange's official team to help you obtain benefits such as a VIP level trial, subject to the exchange's approval.

Security: leaked keys, third-party bots and managed-account scams

• One key per purpose: separate keys for your own strategy, each third-party bot and bookkeeping tools, each with only what it needs, so you can delete just the one that is compromised.
• Third-party platforms get trading only: no withdrawals, bind their published outbound IPs if they have them, and delete the key once you stop using the service.
• Keep keys out of version control: store them in environment variables or a secrets manager, never in code, screenshots or chat groups.
• Review regularly: check API Management for keys you do not recognise, or use the key information endpoint to see each key's permissions and IPs.

Never hand an API key to anyone who offers to trade for you or promises returns, and never a key with withdrawal permission. Taiwan's Financial Supervisory Commission warned in a 22 September 2025 press release that scammers lure people into virtual assets with "guaranteed profit, low risk" pitches, then demand unfreezing fees, deposits or taxes before paying out (FSC press release).

For users in Taiwan: Bybit is not on the FSC list of virtual asset service providers that have completed AML registration (list updated 2026-09-03); see Taiwan VASP registration explained.

FAQ

Can I create a Bybit API key in the app?

No. The Help Center says API keys can only be created and deleted on the website, and new accounts may be unable to create one for the first 48 hours.

How long does a Bybit API key without an IP last?

90 days. After a password change, keys with no IP bound stop working 7 days later. The deadlineDay field of the key information endpoint shows the days left.

What do error 10006 and 403 mean?

10006, "Too many visits!", is the per-UID endpoint limit; slow down that endpoint. 403, "access too frequent", means the IP exceeded 600 requests in 5 seconds; close all connections and wait at least 10 minutes.

Can I use my mainnet key on Demo Trading?

No. Demo Trading is a separate account with its own UID; create a key inside demo mode and connect to api-demo.bybit.com.

Do API orders still earn a rebate?

Bybit's affiliate terms neither exclude nor mention API orders, so the settlement records decide. Note that referral-bound users do not get Pro fees, and accounts in other Bybit incentive programs such as market making may not contribute to affiliate commission.

Do I have to give Quant Nova an API key to bind my rebate?

No. Binding only needs your UID, never an API key, password or withdrawal permission.

Further reading

• Bybit fee rebate guide
• Bybit VIP, Supreme and Pro tiers
• Fee rebates for quant traders
• Bitget API setup guide
• Binance API trading setup

Rate limits, permissions and test environment rules are from Bybit's official V5 API documentation and Help Center, verified 2026-09-28; Bybit may change them, and the official documentation is authoritative. The code is an example only; test before trading live. Rebate rates are set by the exchanges and the platform and may change. For information only, not investment advice.

Data verified: 2026-09-28