Upbit API rate limit and the three Upbit API rule changes of 2026 a trading bot must handle before November 9

2026-10-21

Will an Upbit trading bot written last year still run unchanged this year?

Upbit Korea's developer changelog shows the rules that touch a bot changing three times in 2026. Two changes are already live and one is set for November 9. We put them in date order, then laid out the Upbit API rate limit numbers underneath, using only the official docs.

These are the Korean exchange's figures. Upbit's global docs for Singapore, Indonesia and Thailand list different values, such as 8 orders per second counted per account.

1.Three dates in 2026

First came the withdrawal lock at 15:00 on July 9. Even an API key with withdrawal permission has withdrawals blocked by default until the member unlocks it in the Upbit mobile app (withdrawal lock notice).

The lock cannot be lifted through the API. Keys issued before that time keep working as before, the notice says.

Second, at 21:00 on August 21, the new order group went from 8 requests per second to 12 (order limit notice).

Third is the self-match prevention default planned for November 9, covered in section 3.

2.What the Upbit API rate limit actually is

Rate limit: how many API calls are allowed in a set time. Calls above it are refused.

Upbit counts limits in two ways. Market data calls are counted per IP, and calls that touch orders and balances are counted per pocket (rate limits page).

Market data

Market list, candles, trades, ticker and order book each allow 10 calls per second. Several programs on the same IP share those 10.

Trading

The default group for balance and order lookups allows 30 per second, new orders 12, and order tests 8. Cancel-all is once every 2 seconds.

Keys issued from the same pocket share one limit. Making more keys does not raise it, while a different pocket gets its own count.

WebSocket and browsers

WebSocket allows 5 connections per second and 5 messages per second, with a cap of 100 messages a minute. REST and WebSocket limits are counted separately.

If a request carries an Origin header, as browser calls do, quotation REST and WebSocket drop to once every 10 seconds. A tool that pulls prices straight from a web page hits this first.

When a bot goes over

The sec value in the Remaining-Req response header is what is left for that second. Going over returns 429, and the docs suggest waiting for the next second before retrying.

Repeated 429s lead to a temporary 418 block that gets longer each time. A loop that ignores errors and retries at once is the riskiest code to ship.

3.What to fix before November 9

Self-match prevention (SMP) stops a member's own orders from filling against each other. From November 9, an order sent without smp_type gets cancel_maker by default (SMP default notice).

A bot that keeps buy and sell orders open on the same account can see the resting order cancelled the moment they cross. To keep the old behaviour, send smp_type=none, and post-only orders are left out of this change.

4.Keys and IP registration

The Exchange API is used from a fixed IP that has been added to the allowed list. One key takes up to 10 IPs, and only public IPs are accepted (auth docs).

The main pocket can issue up to 10 keys and each sub-pocket up to 5. Grant only the permissions needed, and note that the Secret Key is shown once, at issue.

The minimum order on the KRW market is 5,000 KRW (KRW market info). Fee rates are best read per account from the order chance API. Server cost for running a bot is covered in our trading server post.

Hiddenpick is a Windows program that keeps on its server the betting rules that pick owners do not make public, and runs them as they are on the PC of the person who received them through a referral code. It currently runs on Evolution live baccarat at Stake (stake.com). Unlike an exchange bot it uses no API key and runs on the browser the user logged into personally, and the full flow is in the baccarat bot guide. We are recruiting national pickster representatives, and those selected receive benefits worth $12,000, a one-year pass (apply at hiddenpick.my/pickster).