How to create a Bitget API key for Bitlot
· 3 min read · Bitlot Team
Bitlot connects to your Bitget account through an API key. This guide shows you how to create one that can read and trade only, lock it to Bitlot's IP addresses, and link it. It takes about five minutes. On Bitget, Bitlot supports USDT-M futures in the Unified Trading Account.
Why a trade-only key matters
An API key is a set of credentials that lets software act on your exchange account, limited to the permissions you tick when you create it. The safest key is the one that can do only what's needed.
Bitlot needs to see your balances and positions, and to place and close orders. It never needs to move money off the exchange, so:
- Never enable withdrawals. Bitlot rejects any key that can withdraw, and re-checks keys regularly. If withdrawal is switched on later, Bitlot stops using the key.
- Restrict the key to Bitlot's IPs. An IP-restricted key only works from the listed servers, so a copied key is useless anywhere else.
With a key like this, Bitlot never holds your trading funds and can never withdraw from your exchange account. Your funds stay on Bitget, under your own login.
Bitget asks you to set a passphrase for the key. It is a third credential, alongside the API key and secret, and Bitlot needs all three. Bitget cannot show it to you again, so write it down.
Step by step
In Bitget, the API settings are under Profile → API Management. Grant Read and Trade, and leave Withdraw switched off.
- 1
In Bitget, open API Management and create an API key for your Unified Trading Account. Choose a passphrase.
- 2
Give it Read and Trade permissions only. Never enable Withdraw; Bitlot rejects keys that can withdraw.
- 3
Restrict the key to trusted IPs and paste in every Bitlot IP listed under Settings → Venues & API keys in the app.
- 4
Enter the API key, secret and passphrase in Bitlot under Settings → Venues & API keys → Bitget.
You'll find the current list of Bitlot IP addresses under Settings → Venues & API keys in the app, in the card for linking a key. Paste in every address shown.
Check the connection
After you save the key, Bitlot checks it straight away. A green status means the key can read and trade, cannot withdraw and is reachable from Bitlot's servers. Your Bitget balance then appears in the app.
Troubleshooting
"IP list incomplete" or the key can't connect. The key's IP restriction is missing one or more Bitlot addresses. Edit the key on Bitget and add every IP listed under Settings → Venues & API keys, then re-check it in Bitlot. Exchanges sometimes take a minute to apply changes.
"Withdrawal enabled". The key has withdrawal permission, so Bitlot won't use it. Delete that key on Bitget and create a new one with withdrawals switched off. Don't just untick the box on the old key: a fresh key is cleaner and its secret has never been exposed with withdrawal rights.
Futures permission missing. Bitlot uses the Bitget Unified Trading Account. If your account is on the classic layout, switch it to Unified in Bitget first, then create the key.
Invalid key or signature. Check that you copied the full API key, secret and passphrase with no leading or trailing spaces. The passphrase is case-sensitive. If in doubt, delete the key and create a new one.
Removing access
You're in control at every step. To cut Bitlot off immediately, delete the API key on Bitget. You can also unlink the exchange in Bitlot under Settings → Venues & API keys. Open positions stay on your Bitget account either way, and you can manage them there.