How to create a read-only Bybit API key, step by step

To create a read-only API key on Bybit, open API management on the Bybit website, choose Create New Key, pick a system-generated key, set its permissions to Read-Only, tick the areas it may read and confirm with your email and Google Authenticator codes. The result is a read-only API key: a tracker can see balances, positions and history with it and can never trade or withdraw. One Bybit rule shapes everything after that: a key that is not bound to IP addresses expires after 90 days.

The steps and rules below follow Bybit’s help centre and API documentation as checked on 5 November 2026. Bybit redesigns its screens from time to time, so a label may read slightly differently on yours.

What do you need before you start?

• The website, not the app. Bybit says API keys can only be created on its website; the Bybit app has no option for it.
• Google Authenticator set up on the account, because the last step asks for its code.
• A little patience on a brand-new account: Bybit may restrict key creation for the first 48 hours after registration.
• A name for the key. One key per app, named after the app, is the habit that keeps the API page readable when you come back to it a year later.

How do you create the key, click by click?

• Open bybit.com/app/user/api-management, or click the profile icon at the top right of the Bybit site and choose API.
• Click Create New Key and choose System-generated API Keys. The other type, self-generated, is for developers who sign requests with an RSA key of their own.
• For key usage, choose API Transaction, and name the key after the app that will hold it, for example TrueHold read-only.
• Set API key permissions to Read-Only. Bybit then lists the areas the key may read, such as orders, positions and asset records. A portfolio tracker needs all of them; in read-only mode a ticked box lets the key see that area, not act in it.
• Choose the IP setting: bind the key to IP addresses, or pick No IP restriction. The next section explains what each choice costs.
• Submit, then enter the verification codes Bybit asks for: a code sent by email and your Google Authenticator code.
• Copy the API key and the secret. Bybit shows the secret only once. If you lose it, delete the key and create another; a fresh read-only key costs nothing.

Why does a Bybit key expire after 90 days?

Bybit’s API documentation puts it plainly: a key created without binding IP addresses expires after 90 days. The expiry date only applies to keys with no IP bound, and to keys on an account whose password has been changed, so check the API page after a password change as well. Gate and MEXC put the same 90-day clock on keys without an IP binding, and the 20-exchange table sets the other exchanges side by side. On Bybit there are two ways to live with it.

• Extend the unbound key. On the API management page, click Edit under IP Address Added, keep No IP restriction, submit and enter your email and Google Authenticator codes. Bybit extends the key to 90 days from that day and keeps the same key and secret, so nothing has to be pasted again anywhere.
• Bind it to IP addresses. A bound key only works from the addresses you list and does not carry the 90-day expiry. It suits a service that calls Bybit from fixed addresses; ask the service for them before you bind.

What about subaccounts?

A key belongs to one account. A key created on the main account reads the main account, and money parked in a subaccount stays out of view unless the reading app asks Bybit for subaccounts specifically. The dependable setup is one read-only key per subaccount that holds money, each connected on its own.

What if the key stops working?

Bybit answers a bad key with a numbered error, and the number says what to fix. These are the ones a tracker is most likely to run into, with Bybit’s own wording:

How do you connect the key to TrueHold?

In TrueHold, open Exchanges, choose Link an exchange, pick Bybit and paste the key and secret. TrueHold asks Bybit what the key can do and refuses a key that Bybit reports as read-write. It then reads the unified trading account and the funding account: balances, open positions, trades, funding payments and transfers. For an unbound key it also reads the expiry date Bybit reports and shows the days left next to the account, so the 90-day clock does not run out unnoticed. If you create a new key instead of extending the old one, replace it in the account settings and the history stays. The Bybit tracker page lists what the connection covers, and how to track Bybit covers what to watch once it is live.

Terms in this article