You create an HTX (formerly Huobi) API key under API Management on the website, and one key works for both spot and futures. HTX's API documentation allows up to 20 keys per main account, with three permissions (read, trade, withdraw) and up to 20 bound IP addresses per key. A key with no IP bound expires after 90 days. Two 2026 changes matter: since March 30, newly registered accounts without KYC Level 2 cannot place futures orders through the API, and the old USDT-M futures API was switched off on July 13, so futures bots must use the V5 endpoints (HTX API docs and announcements, checked 2026-10-17).
This guide covers creating the key, which permissions to tick, sub-account keys, signing and domains, spot and futures rate limits, the cancellation-ratio rule, and how HTX's referral rules treat API orders. Sign up for HTX with code FEEOTTER and link your UID on Fee Otter for a 50% futures rebate (30% automatic rebate from the exchange + 20% extra rebate), 2.5 times a typical 20% code, so half of the fees your bot pays come back.
Key points
- Where: profile menu → API Management on the website. You confirm with SMS, email and Google Authenticator, and the Secret Key is shown only once.
- Three permissions: read, trade, withdraw. Trade covers placing and cancelling orders and transfers. Never enable withdraw on a bot key.
- IPs and expiry: up to 20 IPs (host or network) per key; unbound keys expire after 90 days.
- KYC gate: from March 30, 2026, new users below KYC Level 2 cannot open futures positions via API. Sub-accounts inherit the main account's level.
- Futures need V5: the old USDT-M futures API stopped at 15:59 UTC on July 13, 2026.
- No testnet: HTX shut its spot testnet and tells developers to test on the live environment.
- Rebate: referral commission is paid on net spot and futures fees, and API orders are not excluded. Market makers cannot take part.
Creating the key
From HTX's help article How to apply for API Trading? How to create an API Key? (checked 2026-10-17):
- Log in on the website, click the account icon, choose API Management.
- Fill in the note (required) and, optionally, the IPs to bind, separated by commas.
- Pick the permissions, click Create, and complete the SMS, email and Google Authenticator codes.
- The Access Key and Secret Key appear in a pop-up. The Secret Key is shown only this once; if you lose it, delete the key and make a new one.
- Later you can edit the note, bind IPs or delete the key from the same page.
That article dates from 2019 and says each user can create 5 keys and should bind up to 4 IPs. HTX's current API documentation (Preparation) says 20 keys per main account and 20 IPs per key. Where they differ, go by the API docs and what the management page actually lets you create.
Permissions: which to enable
Per the API docs, one key covers spot, futures and options, with three permissions:
| Permission | What it allows | For a bot? |
|---|---|---|
| Read | Query orders, fills, balances | Always |
| Trade | Place and cancel orders, transfers | Only if it trades |
| Withdraw | Create and cancel withdrawals | No |
Note that trade includes transfers, so a program with trade access can move funds between your accounts. Monitoring and bookkeeping tools only need read.
Sub-account keys
The docs' Sub User section says a main account can create 200 sub-accounts, each with up to 5 keys, and sub-account keys only get read and trade, never withdraw. Sub-accounts cannot transfer to each other; only the main account can move funds. Sub-account keys can be IP-bound and expire on the same rules. One strategy per sub-account limits the damage if a key leaks. How sub-account volume counts for rebates is in sub-account rebate rules.
HTX's docs warn you not to share the Access Key and Secret Key with anyone, including any product or person claiming to be from HTX, and to delete a key at once if it leaks. Linking your account for Fee Otter rebates needs only your UID, never an API key.
KYC level: API limits since March 30, 2026
HTX's announcement on futures leverage limits and API permissions for new users (effective 07:00 UTC, March 30, 2026; checked 2026-10-17) says, for newly registered users:
- No KYC or KYC Level 1 only: no futures orders via API until Level 2 or higher is done.
- Below KYC Level 2: futures leverage capped at 5x.
- Sub-accounts: inherit the main account's KYC level and the same limits.
- Existing positions: unaffected and cancellation still works. Hedge mode can place closing orders, one-way mode can place reduce-only orders; opening, adding, reversing and changing leverage prompt you to verify first.
- Trading bots are not affected by this change; Futures Copy Trading is.
What each KYC level needs is in the HTX KYC guide.
Domains and signing
From the API docs:
| Product | REST domain | Note |
|---|---|---|
| Spot, margin | https://api.huobi.pro, https://api-aws.huobi.pro | Use api-aws if your server is on AWS |
| USDT-M futures | https://api.hbdm.com, https://api.hbdm.vn | hbdm.vn uses AWS CDN, hbdm.com uses Cloudflare |
HTX recommends hosting in AWS Tokyo, advises against proxies, and asks you to call the API from outside mainland China.
- Signature methods: HmacSHA256 or Ed25519, signature version 2. The string to sign is the HTTP method, lowercase host, path and the ASCII-sorted, URL-encoded parameters, joined by newlines; the result is Base64-encoded.
- Timestamp: UTC in
YYYY-MM-DDThh:mm:ss, valid for 5 minutes. Keep the server clock synced. - GET vs POST: GET signs every parameter; POST signs only AccessKeyId, SignatureMethod, SignatureVersion and Timestamp, with the rest in the body.
- New signing: the copy trading API already uses header-based
API-KEY,API-SIGNandAPI-TIMESTAMP, and HTX says other features will move to it over time.
A minimal example that lists your spot accounts (HmacSHA256). A read-only key is enough, and the key comes from environment variables:
import base64, hashlib, hmac, os, urllib.parse
from datetime import datetime, timezone
import requests
ACCESS = os.environ["HTX_ACCESS_KEY"] # read-only key is enough
SECRET = os.environ["HTX_SECRET_KEY"]
HOST, PATH = "api.huobi.pro", "/v1/account/accounts"
params = {
"AccessKeyId": ACCESS,
"SignatureMethod": "HmacSHA256",
"SignatureVersion": "2",
"Timestamp": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S"),
}
query = urllib.parse.urlencode(sorted(params.items()), quote_via=urllib.parse.quote)
payload = "\n".join(["GET", HOST, PATH, query])
sig = base64.b64encode(hmac.new(SECRET.encode(), payload.encode(), hashlib.sha256).digest()).decode()
r = requests.get(f"https://{HOST}{PATH}?{query}&Signature={urllib.parse.quote(sig, safe='')}")
print(r.status_code, r.json())We ran this on 2026-10-17 with a fake key and HTX answered api-signature-not-valid (incorrect Access Key), which means the request format is right. With your own key it returns your account list.
USDT-M futures: the old API is gone, use V5
HTX's API upgrade announcement for the USDT-M futures system (May 26, 2026) set the migration window from 08:00 UTC on May 26 to 15:59 UTC on July 13, 2026. After the deadline the old API was permanently discontinued, and accounts that had not migrated cannot place or cancel orders. Every futures interface except market data (account, orders, positions, algo orders, copy trading) had to be re-integrated.
- HTX suggests creating a test sub-account and calling
/v5/account/asset_modeto switch it to the new single-asset (asset_mode=2) or multi-asset (asset_mode=1) collateral mode. - After switching, that account's private endpoints work only through V5, for example
POST /v5/trade/orderto place orders andGET /v5/account/balancefor balances. - Some trading logic changed too: cross margin now counts potential loss from open orders and can trigger risk-control cancellation, and liquidation now looks only at the maintenance margin ratio on mark price. Recalibrate your strategy parameters; details are in the HTX futures guide.
On spot, the docs say the testnet was closed because few people used it and it cost a lot to run; HTX suggests the live environment instead. With no testnet, start live with small size and low leverage.
Rate limits and the cancellation-ratio rule
From the API docs (checked 2026-10-17):
| Category | Scope | Limit |
|---|---|---|
| Spot order placement | /v1/order/orders/place, all keys under one UID combined | 100 per 2 s |
| Futures private endpoints | Per UID | 144 per 3 s (72 trade + 72 read) |
| Futures public, non-market data | Per IP | 240 per 3 s |
| Futures market data REST | Per IP | 800 per second |
| Futures private WebSocket | Concurrent connections per UID | 30 |
Spot responses carry X-HB-RateLimit-Requests-Remain and futures responses carry ratelimit-remaining, so your code can slow down on its own. Main and sub-accounts are counted separately.
Cancellation ratio: on USDT-M futures, once an API user places 3,000 or more limit, post-only, FOK or IOC orders within 10 minutes, HTX computes the cancellation ratio. Above 99%, those four order types are blocked for 5 minutes; three blocks within an hour means 30 minutes. An "invalid cancellation" is an order with zero fill cancelled within 3 seconds of placement. Cancelling and other order types still work during a block. If your strategy quotes and cancels fast, check this ratio before going live.
Fees and rebates on API orders
Fees: regular HTX users (Prime 0) pay 0.2% maker and taker on spot, and 0.02% maker / 0.06% taker on USDT-M futures. At 5 million USDT of 30-day futures volume you reach Prime 2 with 0.05% taker (full table in HTX VIP fee tiers). HTX lists no separate API fee schedule; your account's fee page is final.
Rebates: under Rules for HTX's Referral Program (checked 2026-10-17), the inviter earns a share of the net trading fees an invitee actually pays on spot or futures. The rules do not exclude API orders, but these are excluded or split:
- Fees on trades using spot cashback vouchers, futures trial bonuses, zero fees or negative fees.
- Market makers are not eligible for the referral program, and the API docs' market maker program says makers cannot use point cards, VIP rates or rebates.
- Users at Prime 9 or above no longer generate referral bonuses for their inviter.
- Orders placed through a broker: at least 70% goes to the inviter and up to 30% to the broker.
So a normal account trading through its own code or the API earns commission like any spot or futures trade, as long as a fee is paid; check your rebate statement to confirm. MEXC is different: its affiliate rules say API trades earn no commission at all.
At a typical bot size: 5 million USDT of monthly futures volume, all taker, puts you at Prime 2 with 0.05% taker, so 2,500 USDT in fees. Through Fee Otter 50% comes back, 1,250 USDT: 750 USDT refunded by HTX into your account and 500 USDT settled daily by Fee Otter. A typical 20% code returns 500 USDT.
This is our own example using HTX's published fees; your fills and rebate statement are what count. Rebates apply to trading fees only, not funding payments. HTX rebate screenshots are on the rebate rates page, sign-up steps in how to register on HTX. An HTX referral code cannot be changed once bound; if you signed up with someone else's code, see the HTX rebind guide. Multi-exchange estimates are in fee rebates for quant traders.
If you are already a VIP at an exchange or run high volume, and want to switch or open an account elsewhere, contact Fee Otter support. We work directly with exchange teams to request special trading benefits or a higher rebate rate; the exchange decides what is granted.
Telegram · @feeotter
