Before you start
- A verified Bybit account in a supported country, with 2FA
- For practice: Demo Trading mode in the same account
- The IP address of the machine running the bot (recommended)
Create your Bybit API key
- 1
Open API management
Log in, open the profile menu and choose API (
bybit.com/app/user/api-management). For a demo key, first switch the account to Demo Trading, then create the key there. - 2
Create a system-generated key
Click Create New Key and choose System-generated API Keys (HMAC). Select API Transaction as the usage and name the key.
- 3
Set permissions
Choose Read-Write. Under Unified Trading, tick Spot → Trade. Leave withdrawals, transfers and other products unticked.
- 4
Bind an IP address
Select Only IPs with permissions granted are allowed and enter your server’s IP. Unbound read-write keys expire after three months.
- 5
Confirm and copy
Submit, pass the 2FA check, then copy the API Key and API Secret. The secret is not shown again.
Test the key
Before wiring the key into a strategy, make one request by hand. It separates “the key is wrong” from “my code is wrong”.
import hashlib, hmac, os, time, urllib.request
key, secret = os.environ["BYBIT_API_KEY"], os.environ["BYBIT_API_SECRET"]
query, ts, window = "accountType=UNIFIED", str(int(time.time() * 1000)), "5000"
sign = hmac.new(secret.encode(), (ts + key + window + query).encode(), hashlib.sha256).hexdigest()
req = urllib.request.Request("https://api-demo.bybit.com/v5/account/wallet-balance?" + query, headers={
"X-BAPI-API-KEY": key, "X-BAPI-TIMESTAMP": ts, "X-BAPI-RECV-WINDOW": window, "X-BAPI-SIGN": sign})
print(urllib.request.urlopen(req).read().decode())"retCode":0 with a wallet list means the key works (use api.bybit.com for a mainnet key). 10003 is an invalid key, 10004 a bad signature.Add the key to your AlgoGP project
- 1
Open your project’s APIs & keys tab
Open the strategy project, select APIs & keys, and under Platforms choose Bybit (Pro).
- 2
Paste each value
Paste the values into
BYBIT_API_KEYandBYBIT_API_SECRETand click Save. Values are encrypted at rest, never shown again and never written into code or exports. - 3
Run locally with the same names
Exported projects read the same names from
.env(copy.env.example). Keep.envout of version control.
BYBIT_API_KEY=paste-your-value-here
BYBIT_API_SECRET=paste-your-value-hereCommon Bybit API errors
10003invalid API key- Wrong key, a live key on the demo host (or the reverse), or a deleted key.
10004error sign- The string signed differs from what was sent; sign the exact query string or JSON body.
10002timestamp error- Clock drift beyond
recv_window; sync with NTP. 10010unmatched IP- The request came from an IP not bound to the key.
Frequently asked questions
Do Bybit demo keys work on the live API?
No. Demo Trading keys only work on api-demo.bybit.com; live keys only on api.bybit.com.
Can I use a sub-account key?
Yes, and it is a good idea: give each bot its own sub-account so a mistake is contained to its funds.
Build a Bybit trading bot in minutes
Describe the strategy in plain English, backtest it on years of data, then export Python that already talks to Bybit: paper, sandbox and live modes, keys handled for you.
- Generated adapter for Bybit orders and balances
- Backtests with costs, slippage and walk-forward checks
- Paper first; live trading only after you opt in
Free plan, no card required. Bybit is included with Pro.
AlgoGP is not affiliated with Bybit. Menus get renamed from time to time; if a label differs, the official documentation has the current path.