How to create a Bybit API key for Bitlot
· 3 min read · Bitlot Team
Bitlot connects to your Bybit account through an API key. This guide shows you how to create one that can read and trade only, lock it to Bitlot's IP addresses, and link it. It takes about five minutes. On Bybit, Bitlot supports USDT perpetual contracts.
Why a trade-only key matters
An API key is a set of credentials that lets software act on your exchange account, limited to the permissions you tick when you create it. The safest key is the one that can do only what's needed.
Bitlot needs to see your balances and positions, and to place and close orders. It never needs to move money off the exchange, so:
- Never enable withdrawals. Bitlot rejects any key that can withdraw, and re-checks keys regularly. If withdrawal is switched on later, Bitlot stops using the key.
- Restrict the key to Bitlot's IPs. An IP-restricted key only works from the listed servers, so a copied key is useless anywhere else.
With a key like this, Bitlot never holds your trading funds and can never withdraw from your exchange account. Your funds stay on Bybit, under your own login.
Choose a system-generated key. Bybit shows the secret only once, so copy it straight into Bitlot.
Step by step
In Bybit, the API settings are under Profile → API. Grant Read-Write access with Contract / Unified Trading permissions, and leave Withdrawal or Transfer switched off.
- 1
In Bybit, open API Management and create a new system-generated key with Read-Write access.
- 2
Enable Contract / Unified Trading permissions only. Leave Withdrawal and Transfer unchecked; Bitlot rejects keys that can withdraw.
- 3
Restrict the key to trusted IPs and paste in every Bitlot IP listed under Settings → Venues & API keys in the app.
- 4
Copy the API key and secret into Bitlot under Settings → Venues & API keys → Bybit.
You'll find the current list of Bitlot IP addresses under Settings → Venues & API keys in the app, in the card for linking a key. Paste in every address shown.
Check the connection
After you save the key, Bitlot checks it straight away. A green status means the key can read and trade, cannot withdraw and is reachable from Bitlot's servers. Your Bybit balance then appears in the app.
Troubleshooting
"IP list incomplete" or the key can't connect. The key's IP restriction is missing one or more Bitlot addresses. Edit the key on Bybit and add every IP listed under Settings → Venues & API keys, then re-check it in Bitlot. Exchanges sometimes take a minute to apply changes.
"Withdrawal enabled". The key has withdrawal permission, so Bitlot won't use it. Delete that key on Bybit and create a new one with withdrawals switched off. Don't just untick the box on the old key: a fresh key is cleaner and its secret has never been exposed with withdrawal rights.
Futures permission missing. Bitlot trades USDT perpetuals in a Unified Trading Account. If your account is still on the classic layout, upgrade it to Unified Trading in Bybit first.
Invalid key or signature. Check that you copied the full API key and secret with no leading or trailing spaces. If in doubt, delete the key and create a new one.
Removing access
You're in control at every step. To cut Bitlot off immediately, delete the API key on Bybit. You can also unlink the exchange in Bitlot under Settings → Venues & API keys. Open positions stay on your Bybit account either way, and you can manage them there.