Best trading bot? Before picking one, compare the official API rules of five exchanges on rate limits, tokens, key expiry, IP and demo trading
2026-10-24
Two monitors are on at an office desk. One shows a list of the best trading bots of the year, the other an exchange's API documentation, and two people keep looking from one table to the other.
The bot list talks about returns and monthly fees. It does not say which exchange API the bot calls or how many orders that API will take in ten seconds. So this piece skips the ranking and lays out the rules of five exchanges with official documentation, side by side.
1.The column the bot lists leave out
Whatever the strategy, a trading bot ends up calling an exchange API. How many requests the API accepts per second, when a token or key stops working, and what happens to a key that sits unused are set by the exchange, and no bot can change them.
Rate limit: requests an API accepts from one IP, key or account in a window. Beyond it come rejections, then a block.
The five compared here are Binance spot, Coinbase Exchange, Kraken spot, OKX and Upbit. Only sentences from official documents or official pages were used, and a cell is left blank where the documents say nothing.
2.Five exchanges compared: limits, tokens, expiry, IP, demo
Request limits
Binance counts request weight per IP, 6,000 per minute, and orders per account, 100 per 10 seconds and 200,000 per day (Binance exchangeInfo, queried 2026-10-22). The limits document states that the limits are based on IPs, not API keys (Binance limits).
Coinbase Exchange allows 10 public requests per second per IP and 15 private requests per second per profile, with bursts up to 15 and 30 (Coinbase Exchange rate limits). Kraken uses a counter per API key: a Starter account has a maximum of 15 that decays by 0.33 per second, while Intermediate and Pro accounts have 20 with decay of 0.5 and 1 per second (Kraken REST rate limits).
OKX accepts 60 place-order requests per 2 seconds per user and instrument, with a sub-account ceiling of 1,000 order requests per 2 seconds (OKX API docs). Upbit's global documentation lists 8 order requests per second per account and 10 market-data requests per second per IP (Upbit rate limits).
Keys on the same account or the same IP share one quota, so two bots on one key each get half.
When tokens and keys stop working
None of the five issues a short-lived access token the way some stock brokers do. All five sign every request with the API key, so what matters is the key itself.
OKX writes that a key with trade or withdraw permission and no linked IP expires after 14 days of inactivity. Kraken offers an optional expiration date on each key, with an example key valid for one week (Kraken API key guide). Upbit has an Expired Keys tab but states no period, and Binance and Coinbase Exchange do not mention key expiry in these documents.
A key that quietly expires while the bot is idle is written into the rules of at least one exchange, so an idle bot can wake up locked out.
IP rules
Binance gives an unrestricted-IP key reading permission only, and withdrawal permission requires an IPv4 restriction (Binance API key FAQ). OKX lets each key bind up to 20 IP addresses.
Upbit requires an allowlisted IP for a key with Make Orders or Withdraw permission (Upbit API key page). Kraken describes IP whitelisting as an option, and Coinbase Exchange says nothing about it on the pages checked.
Demo trading
All five have a way to test without money. Binance runs a Spot Testnet where all funds are virtual and resets happen about once a month without notice (Binance Spot Testnet). Coinbase Exchange has a public sandbox with unlimited fake funds and keys separate from production (Coinbase Exchange sandbox).
OKX adds a header, x-simulated-trading: 1, with demo API keys. Upbit opens an order-test endpoint at 8 requests per second. Kraken's spot documents checked here do not describe a test environment.
3.What changes when a bot is attached
A bot connects in one of two ways. It runs on the user's own PC with the user's key, or the seller's server takes the key and calls the exchange from there. In the second case, the IP that goes into Upbit's allowlist or Binance's withdrawal restriction is the seller's server, and that server's address is shared with the seller's other customers.
Once a key is handed over, its quota is shared with everyone on that server. Ask how many customers use the IP.
Before the returns table, the first thing to check is where the bot calls the key from. That answer decides which row of the tables above becomes the buyer's problem.
4.Four questions before choosing
Q.Does this piece rank the best trading bot?
A.No. It compares the API rules the bots run on, because a bot cannot exceed what the exchange allows, and those rules are published.
Q.Does the seller need my API key?
A.If the bot runs on the seller's server, yes. Binance leaves an unrestricted key read-only, and Upbit requires an allowlisted IP for order permission. A separate key with trade permission only, and no withdrawal, is what the documents allow.
Q.Can a bot sit idle on demo for months?
A.On OKX a key with trade permission and no IP link expires after 14 days of inactivity, and Kraken keys can carry an expiry date. Check the key's state before switching to live.
Q.What happens when the limit is hit?
A.Upbit returns 429 and then a 418 block that gets longer on repeat. Binance escalates to an IP ban from 2 minutes to 3 days. Whether the bot handles those responses is a fair question for the seller.
Hiddenpick is a Windows program that keeps on its server the betting rules that pick owners do not make public, and runs them as they are on the PC of the person who received them through a referral code. It currently runs on Evolution live baccarat at Stake (stake.com). It uses no exchange API key and works from the Chrome window on the user's own PC, and how it starts and stops is in the baccarat bot guide.
We are recruiting national pickster representatives, and those selected receive benefits worth $12,000, a one-year pass. Apply: https://hiddenpick.my/pickster
- 25,000+ real shoes collected and analysed since September 2026
- 90+ baccarat tables from the lobby on one screen · refreshed every 0.35s · seated 2 to 4 seconds after a click
- Stops by itself at your take-profit and stop-loss · tie several PCs into one team and stop on the total
- No browser extension · your money stays in your own Stake account · 12 languages