Gemini Getting Started: API Access & First Request (2026)

Getting started overview

Integrating with the Gemini API involves a series of steps designed to ensure secure and authenticated access to the platform's digital asset services. This guide focuses on the initial setup, including account creation, API key generation, and executing a foundational request. Gemini provides both REST and WebSocket APIs, allowing developers to retrieve market data, manage orders, and access account information programmatically. The platform emphasizes security and regulatory compliance, which is reflected in its account verification and API key management processes. Developers can utilize official SDKs for Python, Node.js, Java, Ruby, and C# to streamline integration Gemini API documentation.

Before making any API calls, users must complete identity verification as part of Gemini's Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance framework. This process is standard for regulated financial platforms to prevent illicit activities and protect user assets, aligning with practices seen across the financial industry FIDO Alliance security standards.

Quick start reference

The following table provides a high-level overview of the essential steps for getting started with the Gemini API:

Create an account and get keys

Account registration

To begin, navigate to the Gemini website and initiate the account creation process. This typically involves providing an email address, setting a password, and agreeing to the terms of service. Once the initial registration is complete, you will be prompted to verify your email address.

Identity verification (KYC/AML)

After email verification, Gemini requires users to complete identity verification. This process is mandatory for all users who wish to deposit, withdraw, or trade on the platform, and by extension, for generating API keys. The verification steps generally include:

• Providing personal details (full name, date of birth, address).
• Uploading government-issued identification (e.g., passport, driver's license).
• Completing a selfie or liveness check.

The duration of the verification process can vary, but generally takes a few minutes to a few business days depending on the completeness of the submitted information and the volume of new registrations. You will receive a notification once your account is fully verified.

API key generation

Once your Gemini account is verified, you can generate API keys. API keys consist of a public key (API Key) and a private key (API Secret). The API Key identifies your application, while the API Secret is used to sign your requests, proving their authenticity and preventing unauthorized access.

1. Log in to your verified Gemini account.
2. Navigate to the "Account Settings" or "API Settings" section. The exact path may vary but is typically found under security or developer options. Refer to the Gemini API documentation for key management for precise navigation.
3. Select the option to "Create New API Key" or "Generate API Credentials."
4. You will likely be asked to provide a label for your API key (e.g., "My Trading Bot") and configure its permissions. For initial testing, you might grant read-only access or specific trading permissions. Exercise caution and only grant the minimum necessary permissions for your application.
5. Upon generation, your API Key and API Secret will be displayed. Crucially, the API Secret is often shown only once. Copy it immediately and store it securely. Do not share your API Secret or embed it directly in client-side code.

Your first request

After obtaining your API keys, you can make your first API call. This example will demonstrate a simple public endpoint request and then an authenticated request using Python, one of Gemini's primary language examples.

Public endpoint example: Fetching ticker data

Public endpoints do not require authentication and can be used to retrieve market data such as current prices, order books, and trade history.

Endpoint: https://api.gemini.com/v1/pubticker/:symbol

Example (Python):

import requests

def get_gemini_ticker(symbol):
    url = f"https://api.gemini.com/v1/pubticker/{symbol}"
    response = requests.get(url)
    response.raise_for_status() # Raise an exception for HTTP errors
    return response.json()

try:
    btc_usd_ticker = get_gemini_ticker("btcusd")
    print("BTC/USD Ticker Data:")
    print(btc_usd_ticker)
except requests.exceptions.RequestException as e:
    print(f"Error fetching ticker data: {e}")

This Python script uses the requests library to fetch the current ticker information for the BTC/USD pair. The response.raise_for_status() call ensures that network or API errors are caught and handled.

Authenticated endpoint example: Getting account balances

Authenticated endpoints require your API Key and a signed payload. Gemini uses HMAC-SHA384 for signing requests. The process involves creating a JSON payload, base64-encoding it, and then signing the encoded payload with your API Secret.

Endpoint: https://api.gemini.com/v1/balances

Example (Python):

import requests
import json
import base64
import hmac
import hashlib
import time

API_KEY = "YOUR_GEMINI_API_KEY"
API_SECRET = "YOUR_GEMINI_API_SECRET".encode('utf-8') # API Secret must be bytes

BASE_URL = "https://api.gemini.com"

def get_gemini_balances(api_key, api_secret):
    endpoint = "/v1/balances"
    url = BASE_URL + endpoint

    nonce = int(time.time() * 1000) # Unique nonce for each request
    payload_data = {
        "request": endpoint,
        "nonce": nonce
    }

    json_payload = json.dumps(payload_data)
    b64_payload = base64.b64encode(json_payload.encode('utf-8'))

    signature = hmac.new(api_secret, b64_payload, hashlib.sha384).hexdigest()

    headers = {
        'Content-Type': "text/plain",
        'Content-Length': str(len(b64_payload)),
        'X-GEMINI-APIKEY': api_key,
        'X-GEMINI-PAYLOAD': b64_payload.decode('utf-8'),
        'X-GEMINI-SIGNATURE': signature,
        'Cache-Control': "no-cache"
    }

    response = requests.post(url, headers=headers)
    response.raise_for_status()
    return response.json()

try:
    # Replace with your actual API Key and Secret
    balances = get_gemini_balances(API_KEY, API_SECRET)
    print("Account Balances:")
    print(balances)
except requests.exceptions.RequestException as e:
    print(f"Error fetching balances: {e}")
except Exception as e:
    print(f"An unexpected error occurred: {e}")

Explanation of the authenticated request:

1. API_KEY and API_SECRET: Replace placeholders with your actual API credentials. The secret must be encoded as bytes.
2. nonce: A unique, monotonically increasing number (usually a timestamp in milliseconds) to prevent replay attacks.
3. payload_data: A dictionary containing the request endpoint and the nonce.
4. json.dumps() and base64.b64encode(): The payload is first converted to a JSON string, then encoded in Base64.
5. hmac.new(): The Base64-encoded payload is signed using HMAC-SHA384 with your API Secret. The result is then converted to a hexadecimal string.
6. Headers: Specific headers (X-GEMINI-APIKEY, X-GEMINI-PAYLOAD, X-GEMINI-SIGNATURE) are required for authentication. The Content-Type is specified as text/plain as per Gemini's API requirements for signed requests.
7. requests.post(): An HTTP POST request is made to the endpoint with these headers.

For more detailed information on request signing, consult the Gemini REST API request setup documentation.

Common next steps

After successfully making your first API calls, consider these common next steps to further your integration with Gemini:

• Explore more endpoints: Review the Gemini REST API reference to understand the full range of available endpoints for trading, order management, account data, and market information.
• Implement WebSocket API: For real-time market data and execution reports, integrate with the Gemini WebSocket API. This is crucial for high-frequency trading applications.
• Error handling: Implement robust error handling in your application to gracefully manage API rate limits, authentication failures, and other potential issues.
• Security best practices: Reinforce the security of your API keys. Consider using environment variables, a secrets management service, or a secure configuration file instead of hardcoding credentials. Implement IP whitelisting for your API keys if supported by Gemini.
• Leverage SDKs: If you are using one of the supported languages, consider using the official Gemini SDKs to simplify API interactions and abstract away the complexities of request signing.
• Testing environment: Utilize Gemini's sandbox or testnet environment (if available and documented) to test your trading logic without risking real funds. Always verify the API documentation for details on test environments.
• Rate limits: Understand and respect Gemini's API rate limits to avoid temporary bans or service interruptions. Implement appropriate delays or queuing mechanisms in your application.

Troubleshooting the first call

Encountering issues during your first API call is common. Here are some troubleshooting tips:

• Authentication errors (401, 403):
  • Incorrect API Key/Secret: Double-check that you are using the correct API Key and Secret. Ensure the secret is handled as bytes during HMAC signing.
  • Incorrect signature: Verify the HMAC-SHA384 signing process. Ensure the payload is correctly JSON-encoded, base64-encoded, and then signed. The secret must be the correct byte string.
  • Incorrect nonce: The nonce must be unique and monotonically increasing for each authenticated request. Using time.time() * 1000 for milliseconds is a common practice, but ensure it's not reused within a short period.
  • Incorrect headers: Confirm that all required headers (X-GEMINI-APIKEY, X-GEMINI-PAYLOAD, X-GEMINI-SIGNATURE, Content-Type) are correctly set. Pay attention to the Content-Type: text/plain for signed requests.
  • API key permissions: Ensure your API key has the necessary permissions for the endpoint you are trying to access (e.g., "Auditor" for read-only, "Trader" for placing orders).
• Network errors:
  • Connection issues: Verify your internet connection.
  • Firewall/Proxy: Check if a firewall or proxy is blocking your outgoing requests to api.gemini.com.
• Bad request errors (400):
  • Malformed JSON payload: Ensure your request body (for POST requests) or payload for signing is valid JSON.
  • Incorrect endpoint path: Double-check the URL and endpoint path for typos.
  • Missing parameters: Some endpoints require specific parameters. Consult the Gemini API documentation for required parameters.
• Server errors (5xx): These typically indicate an issue on Gemini's side. Check the Gemini Status page for any ongoing incidents.
• Time synchronization: Ensure your system's clock is synchronized with NTP (Network Time Protocol). Significant time differences between your system and Gemini's servers can lead to authentication failures due to nonce or timestamp mismatches.