Skip to main content
When creating an API key at Settings → API, Kraken asks you to select permissions. Granting too few causes EGeneral:Permission denied errors. Granting too many exposes you to unnecessary risk if the key is compromised.

​
Permissions by use case

​
Permission descriptions

​
Security best practices

Use IP whitelisting. Lock your API key to the IP addresses your trading system runs from. This single measure prevents almost all key misuse even if the key is leaked. Use separate keys per purpose. Give your market data service a read-only key. Give your order management system a trading key. Give your accounting system a ledger query key. If one is compromised, the blast radius is contained. Never embed keys in source code. Use environment variables or a secrets manager. Rotate keys periodically. Set the minimum permissions required. A key used only for placing orders does not need Withdraw Funds.
Withdrawal permissions should only be enabled on keys that genuinely need to move funds, and those keys should have strict IP whitelisting. A compromised key with withdrawal permissions is a direct financial risk.

​
WebSocket authentication

WebSocket private channels (executions, balances, open orders) require a short-lived token rather than your API key directly. Obtain it via the REST endpoint before opening your WebSocket connection:
The token is valid for 15 minutes. Your API key must have the Access WebSocket API permission enabled.
Use this token in your WebSocket subscription messages — never send your API key directly over WebSocket.

Authentication

HMAC-SHA512 signature generation and nonce management

Sub-accounts

Issue independent API keys per sub-account for strategy isolation

WebSocket authentication

How to use your WebSocket token in subscription messages