All
Filter by:
How do I deposit cash into my account?
I need help with account verification
Why can't I access my account?
Are there any crypto withdrawal fees?
I need help signing into my account
New Funding Endpoints - Permission Changes From Legacy
Kraken's new Funding API simplifies the permission model for many endpoints. Because the same API key works across both Legacy and the new endpoints, some operations that previously required multiple permissions in Legacy now require fewer permissions in the new endpoints. This article explains what has changed and what you should be aware of.
What changed?
In the Legacy Funding API, several read-only endpoints required compound permissions. For example, viewing your withdrawal addresses required both Query Funds and Withdraw Funds to be enabled on the same key.
In the new endpoints, all read-only funding endpoints have been consolidated under a single Query Funds permission. This makes it easier to set up keys for monitoring and reporting without granting unnecessary write access.
However, this also means that an existing API key with Query Funds enabled will be able to access more information through the new endpoints than it could through the legacy endpoints.
Endpoints with reduced permission requirements
The following endpoints require fewer permissions than their Legacy equivalents:
New Endpoints | New Permissions | Legacy Equivalent | Legacy Permissions |
|---|---|---|---|
| listFundingWithdrawals | Query Funds | Get Status of Recent Withdrawals | Withdraw Funds OR Data - Query Ledger Entries |
| listFundingAddresses | Query Funds | Get Withdrawal Addresses | Query Funds AND Withdraw Funds |
| getFundingAddresses | Query Funds | Get Withdrawal Addresses | Query Funds AND Withdraw Funds |
| listFundingMethods | Query Funds | Get Deposit Methods | Query Funds AND Deposit |
| listFundingWithdrawalLimits | Query Funds | Get Withdrawal Methods | Query Funds AND Withdraw |
What this means for your existing API keys
If you have an API key that was created with only the Query Funds permission, that key can now access the following information through the new endpoints it previously could not access through Legacy:
Your withdrawal address list (previously also required Withdraw Funds)
Your withdrawal history (previously required Withdraw Funds or Data - Query Ledger Entries)
Available funding methods (previously also required Deposit)
Withdrawal limits and methods (previously also required Deposit)
Why this matters
If you granted a Query Funds-only key to a third-party service for portfolio tracking or reporting, that service can now retrieve additional account information through the new API, including your withdrawal addresses and withdrawal history. While this data is read-only, this may be more visibility than you intended to share.
Endpoints with unchanged permissions
The following new endpoints require the same permissions as their Legacy equivalents:
Endpoint | Permission | Operation |
|---|---|---|
| createFundingWithdrawal | Withdraw Funds | Create a withdrawal to a whitelisted address |
| listFundingDepositLimits | Query Funds | View deposit limits |
| listFundingDeposits | Query Funds | List deposits |
| listFundingAssets | Query Funds | List available funding assets |
| listFundingNetworks | Query Funds | List available funding networks |
| calculateFundingFees | Query Funds | Calculate deposit/withdrawal fees |
New endpoints and their permissions
The following endpoints are new and have no Legacy equivalent:
Endpoint | Permission | Operation |
|---|---|---|
| claimFundingDepositAddress | Deposit | Generate or claim a deposit address |
| generateFundingLightningAddress | Deposit | Generate a Lightning deposit address/invoice |
| listFundingClaimedAddresses | Query Funds | List deposit addresses |
| createFundingAddress | Add Withdrawal Addresses | Create a withdrawal address |
| deleteFundingAddress | Add Withdrawal Addresses | Delete a withdrawal address |
Recommendations
Review your existing API keys
If you have API keys with Query Funds enabled that are shared with third-party services, review whether you are comfortable with those services accessing additional read-only data through the new endpoints.
Apply the principle of least privilege
When creating new API keys, only enable the permissions your application needs. The simplified permission model makes it easier to grant read-only access without also granting write access.
Use additional security controls
For any API key, especially those with elevated permissions, consider enabling:
Two-factor authentication (2FA) for API keys to require a 2FA code with every API call