API Documentation & Quick Start

API Documentation & Quick Start

The ByteExchange API lets you integrate trading, market data, and account management into your own applications.

API Types

REST API
  • Base URL: https://api.bexc.io/api/v1
  • Alias: https://engine-v3.bexc.io/api/v1 — the same origin; existing integrations keep working.
  • Authentication: API key + HMAC-SHA256 signed requests
  • Best for: Placing orders, managing your account, fetching historical data
WebSocket API
  • URL: wss://engine-v3.bexc.io/ws (an Origin header of bexc.io is required)
  • Authentication: JWT session token only — an API key cannot authenticate a WebSocket connection. Public channels need no authentication.
  • Best for: Real-time market data, order book updates, trade streams
Sandbox

There is no sandbox or testnet environment. Test on production with small amounts.

Quick Start

1. Create API Keys
  1. Go to Settings > API Management.
  2. Create a key with the permissions you need: read, trade, withdraw, perp, copy. A new key is read-only unless you grant more.
  3. Optionally restrict the key to specific IP addresses.
  4. Save your API Key and Secret Key. The secret is shown once and cannot be recovered.
2. Authentication

All private endpoints require a signed request. Include these headers:

  • X-BEXC-API-KEY — your API key
  • X-BEXC-TIMESTAMP — current Unix timestamp in seconds (not milliseconds); the server accepts a ±10 second window
  • X-BEXC-SIGNATURE — HMAC-SHA256 signature, lowercase hex
  • X-BEXC-BODY-HASH — SHA-256 hex of the raw body. Required on POST/PATCH/PUT and must be exactly 64 hex characters, otherwise the request is rejected with HTTP 400 even when the signature is correct. Do not send it on GET/DELETE.

Build the signed message by plain concatenation, with no separators:

``` message = timestamp + METHOD + path + bodyHash

timestamp = the exact string sent in X-BEXC-TIMESTAMP (Unix seconds) METHOD = uppercase HTTP method path = URL path only - the query string is NOT signed bodyHash = sha256_hex(raw body) on POST/PATCH/PUT, empty string "" otherwise signature = hmac_sha256_hex(key, message) key = your API secret in plaintext, exactly as shown at key creation ```

The HMAC key is the plaintext secret. Do not hash or otherwise derive it.

A byte-identical request is rejected for 30 seconds after it is first seen. If a request fails, re-sign it with a fresh timestamp rather than retrying the same bytes.

3. Example — Get Account Balances

`` GET /api/v1/wallet/balances ``

4. Example — Place a Limit Order

`` POST /api/v1/order { "symbol": "BTC_USDT", "side": "buy", "order_type": "limit", "quantity": "0.01", "price": "65000", "time_in_force": "gtc" } ``

Field names and values are case-sensitive: order_type (not type), quantity (not amount), and time_in_force in lowercase.

WebSocket Streams

Subscribe with {"op": "subscribe", "channels": [...]}:

  • ticker:BTC_USDT — ticker updates
  • depth:BTC_USDT:20 — order book updates
  • trades:BTC_USDT — real-time trades
  • balance:user, order:user, execution:user — your private streams (JWT session only)

Rate Limits

Rate limits are tier-based: a higher BEXC tier gets a higher throttle. Exact per-tier numbers come from runtime configuration and are not fixed here. When you exceed a limit the API returns HTTP 429 with a Retry-After header — implement exponential backoff.

Full Documentation

For the complete API reference — every endpoint, its parameters and response formats, plus a downloadable Postman collection — see bexc.io/api-docs.