Watch the walkthrough: How to Use the Ouinex API and Docs
Finding it
Open Ecosystem in the menu. At the bottom is a new tab, API & Docs.
That takes you straight to the API Keys section of your account settings, previously several clicks deep in settings, now one item in the main navigation.
Creating a key
Click Create API key and you are asked for four things before permissions:
A name. Name it after what it does, not after you. spot-rebalance-bot tells you in six months what will break if you revoke it; my-key-2 does not.
An expiration date. Set one. A key with an expiry fails safely if you forget it exists, which is the normal outcome for keys created for a project that ended.
Whether it stays active. A toggle, so a key can be disabled without being deleted. Useful when you want to stop something quickly and investigate afterwards.
IP restriction. You can restrict a key to specific IP addresses. If your code runs on a server with a fixed address, use this. A key that only works from one IP is close to useless to anyone who obtains it, and this is the single most effective control on the page.
You can also enable HMAC if your integration requires request signing.
Permissions, the part that matters
You control what each key can do, across Accounts and Balances, Wallets, Conversions and Payments, and more. Toggle on exactly what you need and nothing else.
The rule is simple and worth following without exception: grant the minimum, and grant it per use case.
A key that only reads balances for a dashboard needs read access to Accounts and Balances and nothing more. If it cannot trade, a compromised key cannot trade. If it cannot touch payments, a compromised key cannot move funds. The permission you did not grant is the incident that cannot happen.
The corollary is one key per purpose. A single key with everything enabled, shared across three scripts, means revoking it breaks all three, so in practice it does not get revoked. Separate keys are separately disposable, and disposability is what makes a key safe.
The API reference
Next to the Create button is API Docs, linking to api.ouinex.com.
It covers getting a Bearer Token, the full endpoint list, and documentation for spot trading, wallets, conversions, derivatives, staking, and real-time data over WebSocket subscriptions.
WebSocket is the one to look at first if you are building anything that reacts to the market. Polling a REST endpoint for prices is slower, heavier, and will reach a rate limit; a subscription pushes updates to you.
Keeping a key safe
The secret is shown once. Store it in a secrets manager or an environment variable. Not in the repository, not in a config file you commit, not in a message to yourself.
Use the expiry. A dated key is one you will either renew deliberately or let lapse harmlessly.
Use the IP allowlist whenever the code runs somewhere with a stable address.
Revoke on suspicion, not on proof. Creating a new key takes a minute. Establishing whether an old one leaked takes considerably longer, and the cost of being wrong is not symmetrical.
Test against a demo account first. An API-driven strategy with an error in its sizing logic will execute that error faster than you can react to it. Run it somewhere it cannot cost you anything until you have watched it behave.
FAQ
Where do I find API keys on Ouinex? Open Ecosystem in the menu and select the API & Docs tab at the bottom. It opens the API Keys section of your account settings.
What permissions should I give an API key? Only the ones the integration actually needs. A read-only dashboard needs balance access and nothing else. Use a separate key for each purpose so any one of them can be revoked without breaking the others.
Can I restrict an API key to a specific IP address? Yes. IP restriction is available when you create the key, and it is the strongest single control available, a key limited to one address is of little use to anyone who obtains it elsewhere.
Where is the Ouinex API documentation? At api.ouinex.com, linked from the API Docs button beside Create API key. It covers Bearer Token authentication, the full endpoint list, and spot, wallets, conversions, derivatives, staking and WebSocket subscriptions.
What happens when an API key expires? It stops working. Setting an expiry date is deliberate. It means a key created for a finished project fails safely instead of remaining valid indefinitely.
The bottom line
Create one key per use case, grant it the minimum permissions that use case needs, set an expiry, and restrict it by IP wherever the code runs somewhere fixed. Those four habits cost a few extra seconds each time and remove almost every way an API key becomes a problem. The reference at api.ouinex.com covers the endpoints; Algo Trading covers what you can build with them.
