To securely interact with the Bitpanda Public API, you need to authenticate your requests using an API key. Your API key acts as a secret token that identifies your account and determines which actions your application is authorized to perform.Generating your API key#
You can create and manage API keys directly within your Bitpanda account.1.
Log in to your Bitpanda account and open your Account settings.
2.
Navigate to the API Keys section.
3.
Click to create a New API key.
4.
Enter a descriptive API key name (e.g., "Portfolio Tracker" or "Trading Bot") to help you identify it later.
5.
Select the required Scopes based on your application's needs (see the scope breakdown below).
6.
Set an Expiration date. Note: For security reasons, Bitpanda keys are valid for a maximum of 1 year.
7.
(Optional but recommended) Toggle the IP allow list to specify exactly which IP addresses are authorized to use this key.
9.
Copy and store the key securely. The full key is displayed only once. If you lose it, you will need to generate a new one.
Using your API key#
Once generated, you must include your API key in the header of all authenticated REST requests. Use the x-api-key header parameter: http
x-api-key: YOUR_API_KEY_STRING
Understanding Scopes#
Scopes define the exact permissions granted to an API key. When creating a key, you must explicitly check the boxes for the endpoints you intend to use.| Scope | Permissions Granted |
|---|
| Trade (Read) | Access market data, view available assets, fiat currencies, and current trading quotes. |
| Trade (Write) | Create new trading quotes and accept them to execute trades. |
| Earn (Read) | View available Bitpanda Earn configurations and monitor your active stakes. |
| Earn (Write) | Execute staking and unstaking actions for supported assets. |
| Balances | Retrieve your current account balances and overall portfolio data. |
| Transaction | Access historical account operations, including deposits, withdrawals, and past trades. |
Security Best Practices#
Warning: Treat your API keys like passwords. Compromised keys can lead to unauthorized access to your account data and funds.
Principle of least privilege: Only enable the exact scopes your application needs. If your integration only reads market data, do not grant it Trade (Write) or Earn (Write) permissions.
Use IP allowlisting: Whenever possible, restrict API access to your server's specific static IP address.
Never commit keys to code: Do not hardcode API keys in your application source code or push them to public repositories (like GitHub). Store them securely using environment variables or a secret manager.
Rotate keys regularly: Keep track of your key's expiration date and plan to generate a new key and update your application before the old one expires.
Modified at 2026-07-06 14:21:09
