EXMO Getting Started: Account Setup & First API Call (2026)

Getting started overview

To begin using EXMO for programmatic trading or market data access, the initial steps involve account creation, security configuration, and API key generation. EXMO offers a REST API that supports various operations, from fetching real-time market data to executing trades and managing user balances. The process is designed to ensure secure access to your account and its functionalities.

The following table provides a quick reference for the essential steps to get started with EXMO:

Create an account and get keys

1. Account Registration

Navigate to the EXMO website and click on the "Sign Up" button. You will need to provide an email address and create a strong password. After submitting, verify your email address by clicking the link in the confirmation email sent to you.

2. Identity Verification (KYC)

EXMO, like other regulated financial service providers, requires users to complete identity verification (Know Your Customer, or KYC) to comply with anti-money laundering (AML) regulations and other legal obligations. This typically involves submitting personal information and identity documents. The specific requirements can vary based on your jurisdiction and desired trading limits. Refer to the EXMO documentation for detailed KYC procedures.

3. Enable Two-Factor Authentication (2FA)

Before generating API keys, it is strongly recommended to enable Two-Factor Authentication (2FA) on your EXMO account. This adds an extra layer of security, protecting your account even if your password is compromised. EXMO typically supports Google Authenticator or similar TOTP (Time-based One-Time Password) applications. To set up 2FA, navigate to your account's "Security" settings and follow the on-screen instructions.

4. Generate API Keys

Once your account is set up and secured with 2FA, you can generate API keys. These keys are essential for authenticating your programmatic requests to the EXMO API. Follow these steps:

1. Log in to your EXMO account.
2. Go to "Settings" or your profile icon, then select "API Keys" or "API Management."
3. Click on "Generate New API Key."
4. You will be presented with a Public Key (sometimes referred to as API Key) and a Secret Key. The Secret Key is shown only once upon generation. Copy both keys and store them securely. Do not share your Secret Key with anyone.
5. Configure permissions for your API key. For initial testing, you might grant read-only access for market data. For trading, you will need to enable trading permissions. Be cautious about granting withdrawal permissions.
6. You may also need to whitelist IP addresses from which you intend to make API calls for enhanced security.

For detailed instructions on generating and managing API keys, consult the EXMO API documentation.

Your first request

After obtaining your API keys, you can make your first authenticated request to the EXMO API. A common first step is to retrieve public market data, such as the order book for a specific trading pair. This example uses cURL, a command-line tool for making HTTP requests, which is useful for quick testing.

Understanding EXMO API Authentication

EXMO's private API endpoints require authentication using your API Public Key and Secret Key. The authentication process typically involves signing your request with your Secret Key using an HMAC-SHA512 algorithm. This signed request, along with your Public Key, is then sent in the HTTP headers.

Public endpoints, such as fetching ticker data or the order book, often do not require authentication. For your first request, we'll use a public endpoint to simplify the process.

Example: Get Order Book for BTC/USDT

Let's retrieve the order book for the BTC/USDT trading pair. This is a public endpoint and does not require API key authentication.

curl -X POST \
  https://api.exmo.com/v1.1/order_book \
  -H 'Content-Type: application/json' \
  -d '{"pair": "BTC_USDT", "limit": 1}'
  

Expected Response (truncated for brevity):

{
  "BTC_USDT": {
    "ask_quantity": "0.0001",
    "ask_amount": "68.00000000",
    "ask_top": "68000.00000000",
    "bid_quantity": "0.0001",
    "bid_amount": "67.99000000",
    "bid_top": "67990.00000000",
    "ask": [
      ["68000.00000000", "0.0001", "6.8"] 
    ],
    "bid": [
      ["67990.00000000", "0.0001", "6.799"] 
    ]
  }
}
  

This response provides the top ask and bid prices and quantities for the BTC/USDT pair. If you receive a similar JSON structure, your connection to the EXMO API is successful.

Making an Authenticated Request (Overview)

For private endpoints (e.g., getting user balance, placing an order), you will need to sign your requests. The general process involves:

1. Create a nonce (a unique, incrementing integer).
2. Construct the request body as a JSON string, including the nonce.
3. Concatenate the JSON request body with the nonce.
4. Sign this concatenated string using your Secret Key and HMAC-SHA512.
5. Send the Public Key (Key header) and the signature (Sign header) along with the request body.

Detailed examples for authenticated requests in various programming languages are available in the EXMO API documentation. Understanding cryptographic signing is a fundamental aspect of secure API communication, as detailed by resources like MDN Web Docs on cryptographic signing.

Common next steps

After successfully making your first API call, consider these next steps to further integrate with EXMO:

• Explore More Endpoints: Review the EXMO API reference to understand available endpoints for market data, account information, and trading operations.
• Implement Authentication: Develop robust authentication logic for private endpoints using your Public and Secret Keys. This will allow you to manage your account and execute trades programmatically.
• Integrate with a Library: While EXMO does not officially provide SDKs, community-contributed libraries might exist, or you can build your own wrapper around the REST API calls in your preferred programming language.
• Error Handling: Implement comprehensive error handling in your application to gracefully manage API rate limits, authentication failures, and other potential issues.
• Webhooks and Notifications: Investigate if EXMO offers webhooks for real-time notifications on events like order fulfillment or balance changes, which can be more efficient than polling the API.
• Security Best Practices: Continuously review and apply security best practices for API key management, such as using environment variables for keys and restricting IP access.

Troubleshooting the first call

If your first API call does not work as expected, consider the following common issues:

• Incorrect Endpoint URL: Double-check that the base URL and endpoint path are exactly as specified in the EXMO API documentation. The example uses https://api.exmo.com/v1.1/.
• Network Connectivity: Ensure your machine has an active internet connection and is not blocked by a firewall from accessing api.exmo.com.
• JSON Formatting: For POST requests with a request body, ensure the JSON payload is correctly formatted. Even a missing comma or bracket can cause parsing errors.
• Content-Type Header: Verify that the Content-Type: application/json header is correctly set for requests with a JSON body.
• Rate Limits: Although less common for a first public endpoint call, repeated rapid requests can trigger rate limiting. Check the EXMO documentation for specific rate limit details.
• API Key Permissions (for authenticated calls): If you are attempting an authenticated call and it fails, ensure your API key has the necessary permissions granted (e.g., read, trade).
• Timestamp/Nonce Issues (for authenticated calls): For authenticated requests, ensure your nonce is unique and incrementing, and that your system clock is synchronized (NTP) to avoid timestamp-related authentication failures. Discrepancies in system time can cause issues with time-sensitive authentication mechanisms, as noted in general API security advice.
• Signature Mismatch (for authenticated calls): The most common error for authenticated calls is an incorrect signature. Carefully review the signing algorithm (HMAC-SHA512), the order of concatenated parameters, and ensure you are using your Secret Key correctly.