Skip to main content

Kraken keys are being rejected

Common causes when the bot says your API keys aren't valid.

Common causes

1. Permissions missing

The bot needs these permissions on the key:

  • Query Funds
  • Query Open Orders & Trades
  • Query Closed Orders & Trades
  • Modify Orders
  • Cancel/Close Orders

If any of these are missing, the validation call fails. Go to kraken.com/u/security/api, edit the key, and ensure all required permissions are checked.

2. IP allowlist mismatch

If you've configured an IP allowlist on the Kraken key, our server must be on the allowlist or the call fails. For a fresh deployment, the simplest path is no IP restriction; alternatively, email support for the current server IP to add.

3. Wrong secret pasted

The "secret" (private key) is a long base64 string. If you accidentally pasted only part of it, or pasted the API key into the secret field by mistake, validation fails. Re-paste both values carefully.

4. Whitespace / line breaks

If you copy-pasted from a multi-line source, hidden whitespace can break the secret. Best to copy directly from Kraken's "Show key" dialog, not from any intermediate file.

5. Key disabled on Kraken's side

If you ever deleted or disabled the key on Kraken's API page, our server's saved copy still has the (now-invalid) value. Generate a fresh key on Kraken, then update at /me/bot/keys.

6. Withdrawal permission enabled (false positive)

We don't require "Withdraw funds" disabled — but if validation seems to randomly fail, double-check that only the permissions listed above are enabled. Reducing the key's authority is always safe.

The bot reports auth failures repeatedly

If the bot's running and seeing repeated auth-failures (which Kraken returns as EAPI:Invalid signature), the bot's exchange layer logs the issue + emits kraken_keys_invalid after a threshold. You'd see this in the activity feed + as a bell-icon notification (if you have in-app notifications enabled).

I just rotated my Kraken keys — what now?

Go to /me/bot/keys and paste the new values. We re-validate before saving. Once saved, the bot picks up the new keys on its next tick (no restart needed).

Don't forget to delete the old key on Kraken's side once the new one is verified.