How to Get Free Bybit API Keys: Step-by-Step Guide for Beginners

An Application Programming Interface (API) acts as a secure bridge between your external software—such as a Python trading script, TradingView alert handler, or automated trading bot—and Bybit's exchange servers. Instead of manually clicking buttons on a website or mobile app, your software sends automated code instructions to place orders, check balances, or fetch price data.

When you generate an API key pair on Bybit, the system provides two distinct cryptographic strings:

Are Bybit API Keys Really 100% Free?

Yes. Bybit does not charge any setup fee, monthly subscription fee, or recurring platform tax for provisioning or maintaining API keys. You can generate up to 20 API keys per master account and sub-account at zero cost. You only pay standard trading fees (Maker and Taker fees) when your software places executed orders in the order book.

Master Account vs. Sub-Account API Keys for Beginners

For complete beginners and automated bot developers, operating under Bybit Sub-Accounts offers an indispensable security layer:

• Master Account API Keys: Have visibility over main wallet balances, sub-account management, and global withdrawal security settings.
• Sub-Account API Keys: Are strictly confined to that specific sub-account ledger. If a sub-account API key is compromised, your master funding wallet and other sub-accounts remain entirely isolated and secure.

Bybit V5 API: The Standard Architecture

Bybit's V5 API engine standardizes data structures across Spot, Linear Futures, Inverse Perpetuals, and Options. It exposes two connection protocols:

• REST API: Used for atomic, state-changing requests such as placing orders, cancelling orders, or checking account balances.
• WebSocket API: Used for low-latency, real-time data streaming such as orderbook changes, ticker updates, and position updates.

Generating your free API key takes less than 3 minutes. Follow these exact steps inside your Bybit account dashboard:

Step 1: Complete Account Identity Verification (KYC Level 1)

Before provisioning API keys, ensure your Bybit account has completed at least Individual KYC Level 1. Bybit requires basic identity verification for all API key creation to prevent malicious abuse and maintain compliance.

Step 2: Navigate to API Management

1. Log into your Bybit account on a secure web browser.
2. Hover over your profile icon in the top right corner of the navigation bar.
3. Click on API or navigate directly to Account & Security > API Management.
4. Click the yellow button labelled Create New Key.

Step 3: Choose System-Generated vs. Self-Generated RSA Keys

Bybit will prompt you to select between two key generation methods:

• System-Generated API Keys (Recommended for Beginners): Bybit's Hardware Security Modules generate both the API Key and API Secret string automatically. This is fast, secure, and compatible with 99% of trading bots and Python libraries.
• Self-Generated RSA Key Pairs (For Advanced Developers): You use OpenSSL on your local terminal to create an asymmetric RSA key pair. You upload only the public key to Bybit, ensuring your private key never leaves your local hardware.

Step 4: Configure Name, Permissions, and IP Binding

In the key creation window, enter a descriptive label (e.g. Python-Spot-Bot-Sub1). Select your required permissions (Read-Only or Read-Write) and enter your server's static IP address into the IP restriction field.

Step 5: Authenticate with 2FA and Save Credentials

Enter your Google Authenticator 2FA code or Email verification code. Bybit will display your new API Key and API Secret string. This is the only time your API Secret will ever be shown. Copy both values immediately into a secure environment file (.env) or password manager.

The single biggest security mistake beginner traders make is checking every single permission box when creating API keys. Following the Principle of Least Privilege means granting your API key only the exact permissions needed for its specific task.

IP Whitelisting is one of the most effective security controls available for API keys. When configured, Bybit's firewall validates the originating IP address of every incoming request.

How to Bind Static IP Addresses

If you host your bot on a cloud server (AWS, DigitalOcean, Hetzner, Vultr), copy your server's public IPv4 address and paste it into the Bybit IP binding field. If you have multiple servers, separate the IP addresses with commas (e.g. 192.0.2.10,198.51.100.25).

Once your API key is generated, you can connect it to your Python scripts. To protect your keys, store your API credentials inside a separate .env environment file rather than placing raw strings inside your Python code.

Step 1: Create a .env File

In your project root folder, create a file named .env and add your keys:

BYBIT_API_KEY="your_public_api_key_here"
BYBIT_API_SECRET="your_private_api_secret_here"

Step 2: Python Authentication Script

Below is a complete Python script demonstrating how to construct an HMAC-SHA256 authenticated REST request to fetch account wallet balances using Bybit V5 API endpoints:

import os
import time
import hmac
import hashlib
import requests
from dotenv import load_dotenv

# Step 1: Load credentials securely from environment variables (.env file)
load_dotenv()

API_KEY = os.getenv("BYBIT_API_KEY")
API_SECRET = os.getenv("BYBIT_API_SECRET")
BASE_URL = "https://api.bybit.com"  # Production Mainnet endpoint

def generate_v5_signature(secret: str, timestamp: int, api_key: str, recv_window: int, payload: str = "") -> str:
    """
    Generates an HMAC-SHA256 signature required for Bybit V5 API authentication.
    Payload concatenation format: timestamp + api_key + recv_window + query_string_or_body
    """
    param_str = f"{timestamp}{api_key}{recv_window}{payload}"
    return hmac.new(
        bytes(secret, "utf-8"),
        bytes(param_str, "utf-8"),
        hashlib.sha256
    ).hexdigest()

def get_account_balance():
    """
    Retrieves real-time account balances under Bybit's Unified Trading Account (UTA).
    """
    timestamp = int(time.time() * 1000)
    recv_window = 5000  # 5-second tolerance for network latency
    endpoint = "/v5/account/wallet-balance"
    query_params = "accountType=UNIFIED"

    # Compute cryptographic signature
    signature = generate_v5_signature(
        API_SECRET, timestamp, API_KEY, recv_window, query_params
    )

    # Required headers for Bybit V5 authenticated requests
    headers = {
        "X-BBI-APIKEY": API_KEY,
        "X-BBI-SIGN": signature,
        "X-BBI-TIMESTAMP": str(timestamp),
        "X-BBI-RECEIVE-WINDOW": str(recv_window),
        "Content-Type": "application/json"
    }

    url = f"{BASE_URL}{endpoint}?{query_params}"
    response = requests.get(url, headers=headers)
    return response.json()

# Operational execution test
if __name__ == "__main__":
    if not API_KEY or not API_SECRET:
        print("[ERROR] Credentials missing! Please set BYBIT_API_KEY and BYBIT_API_SECRET in your .env file.")
    else:
        print("[INFO] Connecting to Bybit V5 API...")
        result = get_account_balance()
        print("[SUCCESS] Account Balance Payload Received:")
        print(result)

Maintaining API security requires ongoing vigilance. Follow this simple security checklist to ensure your trading account remains protected:

When running automated scripts, Bybit's API server returns JSON responses containing numeric error codes if a request fails. Here are the most common error codes beginners encounter and how to fix them: