Select the intended account and permissions. Keys last 30 days; the secret is displayed once and must stay in your integration’s secret store.
Select a numbered step to zoom straight to that control.
Choose the environment and account
Open Profile & settings → External connections → Bots and API → Trading API. For virtual testing, open Sandbox account → Keys & connections → Trading API and use Create sandbox key. Purchased-account keys have a separate Create API key button under Your keys.
On Configure, confirm the Trading account ID and enter a recognisable Key name, such as the name of one bot.
One key belongs to one account. Switching the selected account in the dashboard does not move an existing key to that account.
Select a numbered step to zoom straight to that control.
Set permissions and allowed addresses
Choose Read only for monitoring market data, account state, orders, positions, and fills. Choose Read and trade only when the integration must place, amend, cancel, or close trades.
Allowed addresses is optional. Enter up to five plain IPv4 or IPv6 addresses separated by commas, using the public outbound address of the server that will call QATS. Do not enter a hostname or CIDR range.
An empty address field allows requests from any address with the key. A restricted key is refused from other addresses; your browser address may differ from your bot server’s address.
Choose Continue. Bybit native accounts offer read-only QATS keys; their trading happens on Bybit.
Select a numbered step to zoom straight to that control.
Confirm and save the secret once
On Confirm, check Name, Trading account, Permissions, Allowed addresses, and Valid for. Regular API keys last 30 days; the TradingView webhook expiry is a separate setting.
Choose Create API key only when the settings are correct. On Save key, copy the API key into your server’s secret store and keep the matching Base URL.
Tick I have saved the key in a secure place, then choose Done. After leaving this screen the secret cannot be retrieved. Never include it in browser code, a repository, a URL, screenshots, or support messages.
Send the key as an Authorization: Bearer header over HTTPS. Check an account-read response before sending any write, and retain a unique Idempotency-Key for each intended command.
Select a numbered step to zoom straight to that control.
Replace, revoke, or respond to exposure
For planned rotation, create a replacement for the same environment and account, update your server secret, and test a read before resuming commands.
If a previous command has an uncertain outcome, recover it through its original connection before revoking that connection or retrying through a new key. A replacement connection does not recover the original command.
Under Your keys, choose Revoke for the old purchased-account key, check the confirmation, and choose Revoke key. Sandbox keys have Revoke sandbox key under API sandbox. An expired key requires replacement.
Revocation blocks subsequent requests and closes the key’s market streams. It does not cancel working orders or close positions. Manage exposure in the terminal separately.
If the secret was exposed, stop the integration and revoke the affected key promptly. Review orders and positions, then create a replacement and contact support with IDs and redacted errors.
Common questions
I lost the secret. Can QATS show it again?
Create a replacement key, update and test your integration, then revoke the old connection. The original secret cannot be retrieved.
Does revoking a key close positions?
No. Revocation blocks subsequent requests and closes its market streams. Review and cancel working orders or close exposure in the terminal if that is what you need.
My IP-restricted key works in the browser but not on my bot server.
The allowed address must match the public outbound address of the calling server. Your browser and server can use different addresses. Create a replacement with the correct restriction; never send the secret to support.
Can a replacement key recover a command sent with the old key?
Recover an uncertain command through its original connection before planned rotation. Do not resend through a replacement key as though it were the same command. If the old key is no longer usable, reconcile current orders, fills and positions before another write.
You’re done when…
Your key has the intended account and permissions, and its secret is stored privately outside source code.
If this does not match what you see, use Common questions above or contact support with the page and account details.Continue in QATS
Open the relevant screen to follow the steps in this guide.
Tell us where you got stuck. Never share passwords or access keys.