API keys are one of the primary components of API authentication; they are the API equivalent of your Kraken account's username and password.
API keys are required to call any of the account specific (aka private) API endpoints, namely the account management, trading, funding, and earn endpoints. API keys are not required to call the market data (aka public) API endpoints, as the market data endpoints are not associated with any specific Kraken account.
API keys can be used by any software that interacts with our markets and accounts, such as our REST API command line clients, some mobile apps, third party trading bots, and many other products/services.
Open the account menu (click on the human icon in the upper-right corner of the page)
Select the Settings option
Go to the API tab, then click "Create API key" (you will be able to configure your API key in the next steps)
API keys have several settings and options that must be configured before the API key can be used, notably the name/description and access permissions.
The key name is essentially the name of the API key, and can be almost anything that you prefer, as long as the description is unique (different from the descriptions of any other API keys on the same account).
It is best practice to give your API key a descriptive name, without exposing sensitive information. (such as "Trading Key", "Account Management Key", "Python API Key 6", or "Mobile App Key", for example).
The key permissions determine which account specific (private) API endpoints the API key is allowed to call:
Query Funds is required for the API endpoints that query the account balance information, such as Balance and TradeBalance.
Deposit Funds is required for the funding endpoints related to deposits, such as DepositMethods and DepositAddresses.
Withdraw Funds is required for the funding endpoints related to withdrawals, such as WithdrawInfo, Withdraw and WithdrawCancel.
Query Open Orders & Trades is required for the API endpoints that query already existing orders and margin positions, such as OpenOrders, QueryOrders and OpenPositions.
Query Closed Orders & Trades is required for the endpoints that query previously closed/cancelled orders and margin positions, such as ClosedOrders, QueryOrders and QueryTrades.
Modify Orders is required for the trading endpoints that place new orders, such as AddOrder, EditOrder, and AddOrderBatch.
Cancel/Close Orders is required for the trading endpoints that cancel open or pending orders, such as CancelOrder, CancelAll, and CancelOrderBatch.
Query Ledger Entries is required for the API endpoints that retrieve historical account data from the account ledger, namely Ledgers and QueryLedgers.
Export Data is required for the endpoints that export (download) the account ledger, namely AddExport, RetrieveExport, ExportStatus and RemoveExport.
As an example of using API key permissions correctly, consider an API key that is provided to a third party for trading purposes. Such an API key would definitely require Modify Orders and Cancel/Close Orders permissions, would probably require Query Open Orders & Trades permission, but would almost certainly not require Withdraw Funds permission.
Configuring the permissions appropriately would allow the API client to make trades for the account, but would prevent the API client from accessing any account information or performing funding tasks.
The remaining API key settings are only required for more advanced configurations, hence they can usually be kept at their default values:
WebSocket interface is required to retrieve an authentication token for the WebSocket APIs via the GetWebSocketsToken endpoint.
IP Address Restriction is a security feature that restricts API key use to specific client side IP addresses.
Key Expiration can be used to create an API key that only works for a specific amount of time, such as a key that is only valid for 1 week.
Query Start/End Date/Time is a setting that restricts historical account data requests to a specific time frame, such as a key that could retrieve trading history from this year, but not from any previous years.
Custom Nonce Window is a setting used to overcome networking issues that might cause API requests to arrive out of order, by providing a short time frame (1 second, 10 seconds, etc.) during which API requests with an invalid nonce (a nonce value lower than a previously used nonce value), will not cause an invalid nonce error.
Once the API key settings have been configured appropriately, the new API key can be created by clicking on the Generate key button.
The API key, Private key, and QR code should be treated the same way as your username/password. Please save them in a password manager if you need to access them again later. Do not save them in an unencrypted format!
API keys consist of a public and private key pair, both of which must be provided to the API client software.
API keys can be provided in different ways, for example:
The key pair could be copied and pasted as plain text directly into the API client code. Example: The method used by our PHP API client.
The key pair could be copied and pasted into plain text files that the API client can access. Example: The method used by our command line API client.
Note: The private key is also known as the API secret (or just as the secret) by some API client software.
API keys already provide a secure way to authenticate API access to a Kraken account, but their security can be enhanced even further by adding two-factor authentication (2FA).
API key 2FA can be added to an already existing API key via the Security page and can use either a static password or Google Authenticator.
Note: Adding 2FA to an API key also requires that the API client supports 2FA (provides the 2FA data for each call to the private API methods), otherwise an unexpected error would be returned instead of the desired API output.
Read more about how 2FA works for API keys here.