Skip to content

Bybit

HaasOnline connects to Bybit (spot), Bybit Inverse Contracts and Bybit USDT Perpetual, and to Bybit EU spot. The key is connected to Bybit's Haas third-party application and needs Read-Write with the Unified Trading permissions.

If you don't have a Bybit account yet, sign up at Bybit.

Obtaining the API Key

Log in to Bybit, open the account menu at the top right and click API.

Bybit account menu with API.

On API Management, click Create New Key.

Bybit API Management page with the Create New Key button.

Bybit asks which type of key to create. Choose System-generated API Keys. HaasOnline signs its requests with HMAC, which is what this type uses; Self-generated API Keys (RSA) do not work with HaasOnline.

Bybit Select Your API Key Type dialog with System-generated API Keys and Self-generated API Keys.

Configure the key

Fill in the Create New Key form:

  • API Key Usage: choose Connect to Third-Party Applications.
  • Application Name: choose Haas. Bybit keeps keys bound to a third-party application valid permanently, and the form has no IP field: Bybit already whitelists the Haas app's IP addresses for these keys.

  • API Key Permissions: choose Read-Write, then under Unified Trading tick:

    • Orders and Positions (Contract): HaasOnline places, changes and cancels futures orders and sets leverage and position mode.
    • Trade (SPOT): HaasOnline places and cancels spot orders.
    • USDC Derivatives Trading (USDC Contracts) is optional: HaasOnline doesn't trade Bybit's USDC contracts, but it does no harm.

    Leave Block Trade, everything under Assets (Account Transfer, Subaccount Transfer, Convert) and ByX posts unticked.

Bybit Create New Key form with Connect to Third-Party Applications, the Haas application, Read-Write, and Orders, Positions, USDC Derivatives Trading and Trade ticked under Unified Trading.

Danger

Leave everything under Assets unticked. HaasOnline never needs to move funds to trade for you, and a trading-only key limits what a leaked key could do.

Self-hosted TradeServer

On a self-hosted TradeServer license, HaasOnline connects to Bybit from your own machine, not through the Haas app. Choose API Transaction instead of Connect to Third-Party Applications, tick the same permissions, and bind the key to the public IP address of your machine or server.

Click Submit.

Verify

In Security Verification, click Send Verification Code, enter the code Bybit emails you and your Google 2FA Code, then click Next Step.

Bybit Security Verification dialog with the email verification code and Google 2FA Code fields.

Copy the keys

Bybit then shows the new API key and its secret:

  • API key: goes in the HaasOnline Public key field.
  • Secret: goes in the HaasOnline Private key field.

Danger

Copy the secret now. Bybit shows it only once. If you lose it, delete the key and create a new one.

Adding the API to HaasOnline TradeServer Cloud

Log in to HaasOnline TradeServer Cloud and open Exchange Accounts from the user menu in the top right. The Adding an API to the Platform guide shows these first steps with screenshots.

  1. Click the + button at the bottom of the accounts list (on an empty page it reads Add account)
  2. Select Exchange account
  3. In Connect an exchange account, click Bybit

  4. Under What should this account trade?, choose Bybit for spot trading, or Bybit Inverse Contracts or Bybit USDT Perpetual under Derivatives, then click Continue with .... Each market is its own HaasOnline account, so repeat these steps with the same key to add another market. Bybit EU is for accounts on Bybit's EU platform: create that key on your Bybit EU account. The steps above are for bybit.com, and the EU platform's key form may differ.

    What should this account trade, with Bybit and Bybit EU under Spot and Bybit Inverse Contracts and Bybit USDT Perpetual under Derivatives.

  5. Enter an Account name and leave API Version on Unified account (choose Standard account only if your Bybit account hasn't been upgraded to a Unified Trading Account). Then paste the values from Bybit. On Cloud with a Haas-app key, you don't need to enter IP addresses to whitelist anywhere on Bybit: the Haas app already has them. (A self-hosted API Transaction key is bound to your own server's IP, as above.)

    • Public key → the Bybit API key
    • Private key → the Bybit secret

    Bybit account setup form with the IP whitelist, account name, API Version set to Unified account, public key and private key fields.

    Info

    Check for spaces at the start and end of each value after you paste it. Stray spaces are a common cause of a failed key test.

  6. Click Test keys. When the test passes, click Save account

If the test fails, check that the key is Read-Write with Orders, Positions and Trade ticked, and that API Version matches your Bybit account (Unified or Standard). If it still fails, contact Support.