FTX Getting Started: Account Setup & First API Call (2026)

Getting started overview

Integrating with the FTX API allows programmatic interaction with the FTX cryptocurrency exchange platform for tasks such as managing orders, accessing market data, and handling wallet operations. The process involves creating an FTX account, generating API credentials, and making an initial authenticated request. FTX provides both RESTful endpoints for synchronous operations and WebSocket APIs for real-time data streaming and order updates.

Before making any API calls, it is necessary to complete the account creation and verification steps on the FTX website. API keys are then generated securely within the user's profile, providing the necessary credentials for authentication. Subsequent API requests typically require signing with these keys, following the HMAC-SHA256 standard, to verify the sender's identity and ensure data integrity.

This guide focuses on the foundational steps to establish connectivity and execute a basic API call, setting the stage for more complex integrations. For comprehensive details on specific endpoints and data structures, developers should refer to the official FTX API documentation.

Create an account and get keys

To begin using the FTX API, you must first register for an account on the FTX platform. This process typically involves providing an email address and creating a password, followed by email verification. Due to regulatory requirements and to enable higher trading limits, users will also need to complete Know Your Customer (KYC) verification. This usually requires submitting identification documents and may take some time to process.

Once your account is active and verified, you can proceed to generate API keys. These keys are essential for authenticating your programmatic requests to the FTX API. Follow these steps:

1. Log in to your FTX account on the FTX website.
2. Navigate to your profile settings, typically found under a user icon or 'Settings' menu.
3. Look for an 'API' or 'API Keys' section within your settings.
4. Click on a button or link to 'Create New Key' or 'Generate API Key'.
5. You will be presented with an API Key and an API Secret. It is critical to copy and securely store both of these immediately, as the API Secret will often only be displayed once for security reasons. If you lose your secret, you may need to revoke the key and generate a new one.
6. When generating keys, you may have options to specify permissions (e.g., read-only, trade, withdrawal). For your initial setup, consider creating a key with read-only permissions to test market data or account balance retrieval before granting broader trading permissions. This limits potential risks during initial development and testing.

FTX API keys are used to sign requests sent to the API. This signing process, often using HMAC-SHA256, ensures that the request originates from your account and has not been tampered with in transit. The API key identifies your account, and the secret key is used to generate the unique signature for each request.

Your first request

After obtaining your API Key and Secret, you can make your first authenticated request. This example demonstrates fetching your account information using Python, a common language for API interactions. The principles of authentication apply across other programming languages as well. For this example, we will retrieve the account's subaccounts, which is a read-only endpoint and a good starting point.

Authentication Header Structure

FTX API requests require specific headers for authentication. These include:

• FTX-KEY: Your API Key.
• FTX-TS: A timestamp representing the current time in milliseconds since the Unix epoch.
• FTX-SIGN: The HMAC-SHA256 signature of a message composed of the timestamp, HTTP method, request path, and request body (if present).
• FTX-SUBACCOUNT: (Optional) If you are making requests for a specific subaccount, provide its name.

The message signed to create FTX-SIGN is constructed as follows: <timestamp><HTTP method (uppercase)></api path><request body (if POST/PUT)>. For GET requests, the request body component is empty. The signature is then derived using your API Secret as the key.

Python Example: Fetching Subaccounts

This Python example uses the requests library for HTTP calls and hmac for cryptographic signing.

import requests
import hmac
import hashlib
import time

# Replace with your actual API Key and Secret
API_KEY = "YOUR_FTX_API_KEY"
API_SECRET = "YOUR_FTX_API_SECRET"

BASE_URL = "https://ftx.com/api"

def get_ftx_signed_headers(method, path, body=""):
    timestamp = int(time.time() * 1000)
    signature_payload = f"{timestamp}{method.upper()}{path}{body}".encode('utf-8')
    signature = hmac.new(API_SECRET.encode('utf-8'), signature_payload, hashlib.sha256).hexdigest()

    headers = {
        "FTX-KEY": API_KEY,
        "FTX-TS": str(timestamp),
        "FTX-SIGN": signature,
        "Content-Type": "application/json"
    }
    return headers

# Example: Get subaccounts
endpoint_path = "/api/subaccounts"
url = f"{BASE_URL}{endpoint_path}"
method = "GET"

try:
    headers = get_ftx_signed_headers(method, endpoint_path)
    response = requests.get(url, headers=headers)
    response.raise_for_status() # Raise an exception for HTTP errors
    print("Successfully fetched subaccounts:")
    print(response.json())
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")
    if hasattr(e, 'response') and e.response is not None:
        print(f"Response content: {e.response.text}")

To run this code:

1. Install the requests library: pip install requests.
2. Replace "YOUR_FTX_API_KEY" and "YOUR_FTX_API_SECRET" with your actual keys.
3. Execute the Python script.

A successful response will return a JSON object containing details about your subaccounts. This confirms that your API keys are correctly configured and your authentication signature is valid.

Common next steps

Once you have successfully made your first authenticated request to the FTX API, several common next steps can expand your integration capabilities:

• Explore Market Data Endpoints: Begin by retrieving real-time market data such as spot prices, order books, and historical candles for various trading pairs. This is fundamental for building trading strategies or displaying market information. Refer to the FTX Markets API documentation.
• Implement Order Placement and Management: Develop functionality to place new orders (limit, market, stop-loss), cancel existing orders, and retrieve your open orders or order history. This is often the core functionality for automated trading systems. Carefully consider error handling and idempotency for these critical operations.
• Wallet and Account Management: Integrate endpoints for checking your balances, managing deposits and withdrawals, and transferring funds between your main account and subaccounts. Always prioritize security when handling withdrawal functionality.
• Utilize WebSocket API: For real-time updates on market data (e.g., streaming order books, trades) and user-specific events (e.g., order fills, account balance changes), implement the WebSocket API. This reduces polling and provides lower latency data. The FTX WebSocket API documentation provides details on connecting and subscribing to channels.
• Error Handling and Rate Limiting: Implement robust error handling mechanisms to gracefully manage API responses, including rate limit errors (HTTP 429). The FTX API has rate limits to prevent abuse; understanding and respecting them is crucial for stable integration. Information on rate limits is typically found in the FTX API Overview.
• Subaccounts: FTX supports subaccounts, which can be useful for organizing different trading strategies or managing funds separately. Learn how to create and manage subaccounts programmatically if this aligns with your operational needs.
• Security Best Practices: Review and implement best practices for API key security, such as storing keys in environment variables or a secure vault, setting appropriate key permissions, and regularly rotating keys. Additionally, familiarize yourself with general API security principles as outlined by organizations like OAuth 2.0 specifications for secure API access.

Troubleshooting the first call

When making your first API call to FTX, you might encounter issues. Here are common problems and their solutions:

• Invalid API Key or Secret (HTTP 401 Unauthorized):
  • Issue: The API key or secret in your code does not match the one generated on FTX.
  • Solution: Double-check for typos. Ensure you are using the correct key and secret pair. If in doubt, revoke the existing key on FTX and generate a new one, then update your code.
• Incorrect Signature (HTTP 401 Unauthorized or HTTP 400 Bad Request):
  • Issue: The HMAC-SHA256 signature generated does not match what FTX expects. This is a very common error.
  • Solution:
    • Verify the exact construction of the signature payload: <timestamp><HTTP method></api path><request body>. Ensure the timestamp is in milliseconds, the HTTP method is uppercase (e.g., GET, POST), the path includes the leading slash, and the request body is included (and correctly formatted, often as a JSON string) for POST/PUT requests, but empty for GET.
    • Ensure the API secret is correctly encoded (e.g., .encode('utf-8') in Python) before being used in the HMAC function.
    • Confirm your system clock is synchronized. Significant clock skew can lead to signature mismatches due to incorrect timestamps.
  |
• Incorrect Timestamp (HTTP 400 Bad Request, API message: 'Timestamp too old' or 'Timestamp in future'):
  • Issue: The FTX-TS header's timestamp is too far off from the FTX server's time.
  • Solution: Ensure your system's clock is accurate and synchronized, ideally using NTP. The timestamp sent in the FTX-TS header must be in milliseconds since the Unix epoch.
• Missing or Incorrect Headers (HTTP 400 Bad Request):
  • Issue: One or more required authentication headers (FTX-KEY, FTX-TS, FTX-SIGN) are missing or malformed.
  • Solution: Carefully review your code to ensure all necessary headers are present and correctly formatted, as specified in the FTX authentication guide.
• Network or Connection Issues:
  • Issue: Your request fails to reach the FTX API servers due to network problems.
  • Solution: Check your internet connection. Verify that the base URL https://ftx.com/api is correct. Temporarily disable any firewalls or VPNs that might be interfering with your connection to diagnose.
• Endpoint Not Found (HTTP 404 Not Found):
  • Issue: The API path you are trying to access does not exist.
  • Solution: Refer to the official FTX API documentation to confirm the exact endpoint path and ensure it matches your request.

When troubleshooting, it's often helpful to print out the exact components used to generate your signature (timestamp, method, path, body) and the final signature itself. Comparing these against the expected format detailed in the FTX documentation can quickly reveal discrepancies.