EXMO Authentication: API Keys & Security Practices (2026)

Authentication overview

EXMO provides a REST API that allows users to programmatically interact with the exchange, including accessing market data, executing trades, and managing account balances. Authentication for the EXMO API relies on a combination of an API key and a secret key, which are used to sign requests. This method ensures that only authorized users can perform actions on their accounts and that requests have not been tampered with in transit. The API key identifies the user, while the secret key is used to create a unique signature for each request, verifying its authenticity.

The signing process typically involves hashing a concatenated string of request parameters, a nonce, and the API key itself with the secret key using the HMAC-SHA512 algorithm. This approach is a common practice in securing RESTful APIs, particularly in financial contexts where data integrity and non-repudiation are critical. For a general understanding of cryptographic hash functions like SHA-512, refer to the NIST Secure Hash Standard.

Supported authentication methods

EXMO's API primarily supports a single, robust authentication method for programmatic access:

This method requires the generation of specific credentials—an API key and a secret key—from within the user's EXMO account. The API key is included in the request headers, while the secret key is used to generate a cryptographic signature that accompanies the request. This signature verifies the request's origin and integrity, preventing unauthorized modifications.

Getting your credentials

To obtain the necessary API key and secret for EXMO, follow these steps within your EXMO account:

1. Log in to your EXMO account: Access your account through the official EXMO website.
2. Navigate to API Keys: Once logged in, go to the 'API Keys' section, typically found under 'Profile' or 'Settings'. The exact path may vary, so consult the official EXMO API documentation for the most current navigation.
3. Generate New API Key: Click on the option to 'Create New API Key' or similar.
4. Configure Permissions: When generating the key, you will be prompted to set permissions. Carefully select only the permissions required for your application (e.g., 'Read Info', 'Trade', 'Withdraw'). Granting minimal permissions adheres to the principle of least privilege and enhances security.
5. Record Keys: EXMO will display your API key and secret key. The secret key is typically shown only once upon generation. It is crucial to record both keys immediately and store them securely. If you lose your secret key, you will likely need to generate a new API key pair.
6. IP Whitelisting (Optional but Recommended): For enhanced security, EXMO often allows you to whitelist specific IP addresses that can use the API key. If your application will always originate from a static IP, configure this setting to restrict access to only those IPs.

Ensure that your secret key is never exposed in client-side code, public repositories, or transmitted insecurely. For server-side applications, store the secret key in environment variables or a secure key management system.

Authenticated request example

An authenticated request to the EXMO API typically involves sending an HTTP POST request with specific headers and a signed payload. The signature is generated using HMAC-SHA512 with your secret key.

Python Example

This Python example demonstrates how to construct and sign a request to the EXMO API for retrieving account information. This example uses the requests library for HTTP communication and hmac and hashlib for cryptographic operations.

import requests
import hmac
import hashlib
import time
import json

API_KEY = "YOUR_API_KEY"
SECRET_KEY = "YOUR_SECRET_KEY".encode('utf-8') # Secret key must be bytes

BASE_URL = "https://api.exmo.com/v1.1"

def make_signed_request(method, params=None):
    if params is None:
        params = {}
    
    # Add nonce to parameters
    params['nonce'] = str(int(time.time() * 1000))

    # Convert parameters to JSON string
    json_params = json.dumps(params)

    # Create message for signing
    message = json_params.encode('utf-8')
    
    # Generate signature
    signature = hmac.new(SECRET_KEY, message, hashlib.sha512).hexdigest()

    headers = {
        "Content-Type": "application/json",
        "Key": API_KEY,
        "Sign": signature
    }

    try:
        response = requests.post(f"{BASE_URL}/{method}", headers=headers, data=message)
        response.raise_for_status()  # Raise an exception for HTTP errors (4xx or 5xx)
        return response.json()
    except requests.exceptions.HTTPError as err:
        print(f"HTTP error occurred: {err}")
        print(f"Response body: {response.text}")
    except Exception as err:
        print(f"An error occurred: {err}")
    return None

# Example usage: Get user info
# Ensure your API key has 'Info' permission
user_info = make_signed_request("user_info")

if user_info:
    print("User Info:")
    print(json.dumps(user_info, indent=2))

# Example usage: Get order book (public method, no authentication needed)
# For public methods, you would not use make_signed_request
# public_response = requests.get("https://api.exmo.com/v1.1/order_book?pair=BTC_USD&limit=1")
# print(public_response.json())

Explanation:

• API_KEY and SECRET_KEY: Replace placeholders with your actual credentials. The secret key must be encoded to bytes.
• nonce: A unique, monotonically increasing number (often a timestamp) included in each request to prevent replay attacks.
• json_params: The request parameters are converted into a JSON string, which then forms the message body.
• hmac.new(...): This function generates the HMAC-SHA512 signature. It takes the secret key, the message (JSON parameters), and the hashing algorithm as input.
• headers: The Key header contains your API key, and the Sign header contains the generated signature.
• requests.post(...): Sends the HTTP POST request to the specified EXMO API endpoint with the constructed headers and JSON data.

For detailed parameter requirements for specific API methods, refer to the EXMO API documentation.

Security best practices

Adhering to security best practices is essential when integrating with any cryptocurrency exchange API. For EXMO, consider the following:

• Principle of Least Privilege: When generating API keys, grant only the minimum necessary permissions. For example, if your application only needs to read market data, do not grant trading or withdrawal permissions. Regularly review and revoke unused or overly permissive keys.
• Secure Storage of Secret Keys: Never hardcode API secret keys directly into your application's source code. Store them in secure environment variables, a dedicated secrets management service (e.g., AWS Secrets Manager, Google Secret Manager), or a secure configuration file that is not committed to version control.
• IP Whitelisting: Utilize EXMO's IP whitelisting feature if your application operates from a static set of IP addresses. This restricts API access to only those approved IPs, significantly reducing the attack surface.
• Rate Limiting and Error Handling: Implement robust rate limiting in your application to avoid exceeding EXMO's API limits, which can lead to temporary bans. Implement comprehensive error handling to gracefully manage API responses, including authentication failures.
• Nonce Management: Ensure your nonce generation is correct and truly unique for each request to prevent replay attacks. Using a timestamp (as shown in the example) is a common and effective method.
• Secure Communication (HTTPS): Always communicate with the EXMO API over HTTPS. This encrypts data in transit, protecting your requests and responses from eavesdropping.
• Regular Key Rotation: Periodically rotate your API keys. This practice limits the window of exposure if a key is compromised. When rotating, generate a new key pair, update your application, and then revoke the old key.
• Multi-Factor Authentication (MFA) for Account Access: While not directly for API calls, always enable MFA on your EXMO user account. This provides an additional layer of security for accessing and managing your API keys and funds. The FIDO Alliance promotes strong authentication standards like MFA.
• Monitoring and Alerting: Implement logging and monitoring for your API interactions. Set up alerts for unusual activity, failed authentication attempts, or unexpected responses.