Sign in

How to create and manage API keys

April 15, 2026

Paribu API keys allow you to integrate your account securely with automated systems such as bots, portfolio trackers, or your own applications. API keys can only be created and managed via paribu.com; account verification and two-factor authentication (2FA) must be active on your account.

What is an API key?

An API key is a credential pair that lets you grant a permitted copy of your Paribu account to an external software. Each key consists of these two parts:

  • API key: The public code generated specifically for you, used to access the Paribu API infrastructure
  • Secret key: The digital signature that verifies the requests being made are genuinely yours

When you create an API key, you can determine which actions it is allowed to perform (permissions), which IP addresses it can be used from, and how long it remains valid.

Warning: Never share your secret key with third parties. Anyone who has the secret key can perform actions on your account within the permissions you assigned to the API key.

Prerequisites

To create an API key, the following conditions must be met on your account:

  • Account verification (KYC) must be completed. The API keys menu only appears for verified accounts
  • Two-factor authentication (2FA) must be active. OTP verification with Google Authenticator is requested when creating a key. If 2FA is not yet set up, the key creation flow redirects you to the setup page

Note: API key creation and management is available only on paribu.com. The Paribu mobile app does not include an interface for API keys; all the steps below are performed via paribu.com

How do you reach the API keys window?

On paribu.com, API keys are managed in the API keys window opened from the Security settings menu. In the window, you can view your existing keys, create new keys, edit a key's name and IP permissions, or delete a key.

  1. Sign in to Paribu.com
  2. Hover over the profile icon at the top right and click Security settings in the menu that appears
  3. In the security settings window that opens, click API keys
  4. Your existing API keys are listed; if you do not yet have a key, an empty-state message and a Create key button are shown

How do you create an API key?

To create a new API key, follow the steps below:

  1. In the API keys window, click the + icon at the top right or the Create key button on the empty list
  2. Enter a name you can recognize the key by in the Key name field (for example, Spot trading bot or Portfolio tracker app)
  3. Select the permissions you want to grant the key from the Permissions field (see the table below)
  4. If you prefer, turn on the Allowed IP addresses option and enter the IP addresses that can use the key
  5. If you prefer, turn on the Validity period option and set the start and end dates
  6. Click the Continue button
  7. On the Google Authenticator verification screen that opens, enter the 6-digit code shown in the app
  8. Once verification is complete, the API key and Secret key are shown one time in the window that opens; copy both keys to a secure location

Warning: The secret key is shown once at creation and cannot be viewed again later. Be sure to copy the secret key and save it somewhere secure before closing the window; otherwise, you will need to create a new key

Permission types

Paribu API keys have three core permission groups. It is recommended to select only the permissions required for the scenario the key will be used in.

  • All: Includes all permissions below; can be used for integrations that require unrestricted authority
  • Trading: Provides order creation, order cancellation, viewing open orders, reading order details, and access to transaction history
  • Withdrawal: Includes creating a withdrawal request, canceling a withdrawal, accessing transfer history, and assigning addresses

Regardless of which permission group is selected, the key can always access basic information (user information and asset list).

Note: Apply the principle of least privilege: do not grant Withdrawal permission to an app that only needs to read. Keeping permissions as narrow as possible minimizes potential losses if the key is compromised

Allowed IP addresses

If you want to use your API key only from specific servers, you can turn on the Allowed IP addresses option and add the IP addresses you allow. While this feature is active, requests coming from IP addresses you have not authorized are rejected.

  • You can add up to 20 IP addresses
  • Only IPv4 addresses are accepted (for example, 203.0.113.42)
  • The same IP address cannot be added more than once

How do you view your API key?

You can see the API keys you have created in the list within the API keys window. When you click on a key in the list, the detail screen opens; this screen contains the following information:

  • Key name
  • API key (copyable via the copy icon)
  • Creation date
  • Validity date (if you set a validity period)
  • Allowed IP addresses (if defined)
  • Status label: Active, Inactive, or Expired

Note: The secret key is only shown at creation; you cannot view the secret key again on the detail screen. If you have lost your secret key, you need to delete the existing key and create a new one

Editing an API key

You can later edit the name and allowed IP addresses of an existing API key. The permission type and validity date cannot be changed after creation; if you want to change this information, you need to delete the key and create a new one.

  1. In the API keys window, click the key you want to edit
  2. On the detail screen that opens, click the Edit button
  3. Update the key name or allowed IP addresses
  4. Click the Save button to apply the changes

Deleting an API key

You can delete an API key you no longer use or whose security you suspect. A deleted key is immediately deactivated, and any API requests made with that key are rejected.

  1. In the API keys window, click the key you want to delete
  2. On the detail screen, click the Delete button
  3. Review the warning in the confirmation window that opens and click the Delete button to complete the action

Warning: The deletion is irreversible. You cannot recreate the same key; when needed, you will have to create a new key and update the key information in the app you have integrated with

Security recommendations

Because API keys provide automated access to your account, they are as critical as your password. To keep your keys safe, the following recommendations are advised.

  • Principle of least privilege: Grant the key only the permissions the app actually needs
  • Use IP restrictions: If you know the IP address of the server the key will be used from, define an allowed IP list
  • Set a validity period: Create time-limited keys for temporary projects; the key is automatically deactivated when the period expires
  • Store the secret key in an encrypted location: Do not write the secret key in the codebase, in screenshots, or in shared chats; use secure methods such as environment variables or a password manager
  • Review regularly: Delete keys you no longer use; track expiration dates for active keys
  • Delete immediately if leakage is suspected: If you suspect your key has been compromised, delete the key right away and create a new one

Note: When you freeze or close your account, your existing API keys are automatically deleted. Even if you reactivate your account, deleted keys do not return; you need to recreate any keys you need

API documentation

You can find detailed technical information about API endpoints, authentication methods, and example requests on the Paribu API documentation.

Frequently asked questions

Can I create an API key from the mobile app?

No. API key creation, viewing, and management can only be performed via paribu.com. The mobile app does not include an interface for API keys.

I lost my secret key. How can I view it again?

The secret key is only shown once at creation and cannot be viewed again later. If you have lost your key, you need to delete the existing key and create a new one; do not forget to update the new key information in the app you have integrated with.

How many API keys can I create at the same time?

You can create more than one API key on your account and assign different permissions to each. Using separate keys for different apps enhances your security; if one key is compromised, your other keys are not affected.

Why is 2FA required to create an API key?

The API key is critical information that provides automated access to your account. Two-factor authentication ensures that the key can only be created by the actual account holder. If 2FA is not active on your account, the key creation flow first redirects you to the 2FA setup page.

Can I change the permission type of my API key later?

No. The permission type and validity date are set during creation and cannot be changed afterward. You can only update the key name and allowed IP addresses. To change the permission scope, you need to delete the existing key and create a new one with the new permissions.

What happens to my API keys if I freeze my account?

When freezing or closing your account, all your existing API keys are automatically deleted. Even if you reactivate your account, deleted keys do not return; you need to create new keys for your integrations.

Related articles

Author:

Paribu