Binance Authentication: API Key & Signature Methods (2026)

Authentication overview

The Binance API requires authentication for most requests that interact with user-specific data, such as placing orders, checking account balances, or managing user assets. Public endpoints, which retrieve general market data like current prices or order book depth, typically do not require authentication. For private endpoints, Binance employs a signature-based authentication mechanism to ensure the integrity and authenticity of API requests Binance Spot API Guide. This method combines an API Key for identification with a cryptographic signature generated using a Secret Key.

The core principle involves signing each request with your unique Secret Key, which only you and Binance possess. This signature allows the Binance server to verify that the request was indeed sent by you and that its parameters have not been altered since you signed it. This approach helps protect against unauthorized access and man-in-the-middle attacks. Understanding the distinction between public and private endpoints is crucial for efficient and secure API integration Binance API authentication methods.

Supported authentication methods

Binance primarily supports API Key authentication combined with HMAC SHA256 signatures for securing requests to private endpoints. WebSocket streams also utilize API keys for user-specific data streams.

API Key + HMAC SHA256 Signature

This is the standard authentication method for all private REST API endpoints. It involves:

• API Key: A unique identifier for your application or user account. It is included in the request headers or as a query parameter.
• Secret Key: A confidential key used to generate a cryptographic signature for each request. It should never be transmitted over the network directly.
• Signature: A hash generated using the request parameters and your Secret Key. This signature is appended to the request.

The HMAC SHA256 algorithm ensures that the request's parameters have not been tampered with and that the request originates from an authorized source. The process typically involves concatenating all request parameters, hashing them with the Secret Key, and then appending the resulting hash as a signature parameter to the request Binance Signed Endpoint Examples.

WebSocket Authentication

For WebSocket streams that provide user-specific data (e.g., account updates, order updates), authentication is also required. This typically involves sending a listen key that is generated via a REST API endpoint (which itself is authenticated using API Key + HMAC SHA256 signature) Binance User Data Streams. The listen key then authenticates the WebSocket connection for a limited time, requiring periodic renewal.

Authentication Methods Table

Getting your credentials

To interact with Binance's authenticated API endpoints, you need an API Key and a Secret Key. These are generated within your Binance account dashboard.

1. Log in to your Binance account: Access your account through the official Binance website Binance homepage.
2. Navigate to API Management: After logging in, go to your profile section, usually found under 'Account' or the user icon. Look for 'API Management' or 'API Key' in the dropdown menu or settings panel.
3. Create New API Key: Click on the 'Create API' or 'Generate New API Key' button. You might be prompted to complete security verifications, such as 2FA (Two-Factor Authentication) or email/SMS verification.
4. Label Your API Key: Provide a descriptive label for your API key. This helps you identify its purpose and manage multiple keys effectively.
5. Set Permissions: Carefully configure the permissions for your API key. Binance allows you to restrict API keys to specific actions (e.g., 'Enable Reading', 'Enable Spot & Margin Trading', 'Enable Futures'). Never enable withdrawal permissions for API keys used by automated systems unless absolutely necessary and with extreme caution.
6. Record Your Keys: Once created, Binance will display your API Key and Secret Key. The Secret Key is shown only once. You must copy and store it securely immediately. If you lose it, you will need to revoke the key and generate a new one.
7. IP Whitelisting (Optional but Recommended): For enhanced security, consider restricting API access to specific IP addresses. This ensures that only requests originating from your whitelisted IP addresses can use the API key.

After generating, your API Key will be visible in the API Management section, but your Secret Key will be masked. You can always revoke an API key if it is compromised or no longer needed Binance API Key Generation.

Authenticated request example

Here's an example of how to make an authenticated request using Python, specifically to check your account information (a signed endpoint). This example uses the requests library and demonstrates the HMAC SHA256 signing process.

import hashlib
import hmac
import json
import requests
import time

API_KEY = "YOUR_API_KEY"
SECRET_KEY = "YOUR_SECRET_KEY".encode('utf-8')  # Secret key must be bytes
BASE_URL = "https://api.binance.com"

def get_binance_signature(data):
    query_string = '&'.join([f"{k}={v}" for k, v in data.items()])
    m = hmac.new(SECRET_KEY, query_string.encode('utf-8'), hashlib.sha256)
    return m.hexdigest()

def get_account_info():
    endpoint = "/api/v3/account"
    timestamp = int(time.time() * 1000)

    params = {
        "timestamp": timestamp
    }

    signature = get_binance_signature(params)
    params["signature"] = signature

    headers = {
        "X-MBX-APIKEY": API_KEY
    }

    try:
        response = requests.get(f"{BASE_URL}{endpoint}", headers=headers, params=params)
        response.raise_for_status()  # Raise an exception for HTTP errors
        return response.json()
    except requests.exceptions.HTTPError as http_err:
        print(f"HTTP error occurred: {http_err}")
        print(f"Response content: {response.text}")
    except Exception as err:
        print(f"Other error occurred: {err}")
    return None

if __name__ == "__main__":
    account_data = get_account_info()
    if account_data:
        print(json.dumps(account_data, indent=2))

In this example:

• get_binance_signature: This function takes a dictionary of parameters, converts it into a URL-encoded query string, and then computes the HMAC SHA256 signature using your SECRET_KEY.
• get_account_info: This function constructs the request, includes the necessary timestamp, generates the signature, adds the API Key to the X-MBX-APIKEY header, and sends a GET request to the /api/v3/account endpoint.
• The timestamp parameter is crucial for signed requests, preventing replay attacks. Binance requires the timestamp to be within a certain window of their server time Binance Timestamp requirements.

Security best practices

Securing your API keys and integrating with the Binance API requires adherence to several best practices to prevent unauthorized access and potential financial loss.

• Keep Secret Keys Confidential: Your Secret Key is equivalent to your password. Never expose it in client-side code, commit it to version control systems (like Git), or share it publicly. Store it in environment variables, a secure configuration management system, or a secrets manager Google Cloud Secret Management.
• Use IP Whitelisting: Always restrict API key access to specific, trusted IP addresses. This significantly reduces the risk if your API key is compromised, as it can only be used from authorized locations.
• Grant Least Privilege: Assign only the necessary permissions to each API key. For example, if an application only needs to read market data and account balances, do not enable trading or withdrawal permissions.
• Regularly Rotate API Keys: Periodically revoke old API keys and generate new ones. This limits the window of exposure if a key is ever compromised without detection.
• Implement Time Synchronization: Ensure your system's clock is synchronized with a reliable Network Time Protocol (NTP) server. Significant time differences between your server and Binance's server can cause signature validation failures due to the timestamp parameter.
• Handle Nonces/Timestamps Correctly: For signed requests, include a timestamp parameter. Be aware of Binance's server time tolerance (typically 1000ms by default) to avoid timestamp validation errors.
• Secure Your Development Environment: Protect your local development machine and deployment servers. Use strong passwords, 2FA, and keep software updated.
• Monitor API Usage: Regularly review your API key usage logs (if available) for any suspicious activity or unexpected requests.
• Error Handling: Implement robust error handling in your application to gracefully manage API rate limits, authentication failures, and other potential issues without exposing sensitive information.
• Use Official SDKs (where appropriate): While manual signing is possible, using official or well-maintained community SDKs can streamline the authentication process and reduce the likelihood of implementation errors Binance Official SDKs.