Skip to main content

Kraken API keys

How to generate and save the API key + secret the bot needs to trade on your behalf.

Why the bot needs Kraken keys

Your bot places orders on Kraken on your behalf. To do that, it needs Kraken API credentials with the right permissions — and only the right permissions. Your funds never leave Kraken; we never custody them. See We don't custody your funds.

1. Sign in to Kraken

Visit kraken.com/u/security/api and sign in to your existing Kraken account. (If you don't have one, create one first — Kraken's signup is separate from VolatilityFarmer.)

2. Generate a new API key

Click "Generate New Key" or "Add key." For permissions, enable ONLY these:

  • Query Funds — read your balances.
  • Query Open Orders & Trades — see your active orders.
  • Query Closed Orders & Trades — read your trade history.
  • Modify Orders — place / cancel / amend orders.
  • Cancel/Close Orders — explicit cancel permission.

Do NOT enable withdrawal permissions. The bot doesn't need them; granting them would let a compromised key move funds out of your Kraken account.

3. Save the key + secret

Kraken shows the API key + private key (secret) once. Copy both to a temporary text editor — you'll paste them into VolatilityFarmer in the next step. After you close the Kraken page, the secret is unrecoverable; you'd have to generate a new key.

4. Paste them into VolatilityFarmer

Go to your bot's API keys page and paste the key + secret into the two fields. Click "Save keys." We:

  • Encrypt both values at rest using Fernet (cryptography library) with a key stored at /etc/volatilityfarmer/master.key on the server.
  • Run a one-time validation call against Kraken to confirm the keys work.
  • Never display the raw values after saving.

5. What if my keys don't validate?

See Kraken keys are being rejected for the common causes.

Rotating your keys later

You can update your saved keys at any time from /me/bot/keys. Generate a fresh pair on Kraken's side, paste them in, and we'll re-validate and overwrite the old ones. The old keys remain valid on Kraken's side until you delete them from Kraken's API page — we recommend deleting any keys no longer in use.