Skip to main content

​
API Key Authentication

All API requests must include an API key in the x-api-key header.

​
Creating an API Key

  1. Log in to your bitbybit dashboard
  2. Navigate to Settings > Developer
  3. Click Create API Key
  4. Give it a name and select the scopes (permissions) it needs
  5. Click Create and copy the key immediately
The raw API key is only shown once at creation time. Store it securely — you won’t be able to retrieve it again.

​
Key Format

​
Scopes

API keys are scoped to specific resources and actions. Available scopes: A key with READ access to customers can list and get customers, but cannot create or update them.

​
Key Rotation

To rotate an API key without downtime:
  1. Go to Settings > Developer
  2. Click the menu on your active key and select Rotate
  3. A new key is created and the old key gets a 24-hour grace period
  4. Update your application with the new key
  5. The old key automatically stops working after the grace period

​
IP Whitelisting

You can restrict an API key to specific IP addresses or CIDR ranges. When configured, only requests from those IPs are accepted — all others receive a 403 error. See IP Whitelisting for setup instructions and supported formats.

​
Error Responses