Kraken Bot Setup: API Keys, Permissions and Testing

Setting up a bot on Kraken comes down to four steps: create an API key with the narrowest permissions the bot needs, restrict it to known IP addresses, connect it to the bot platform, and test the configuration before real capital is involved. Kraken allows API-based automation, and its own documentation describes the process. This guide walks through each step, explains why the order matters, and lists what to check before you choose a platform.

TL;DR

• A Kraken bot connects through an API key. Grant only the permissions the bot needs and never enable withdrawal.
• Restrict the key to specific IP addresses and use a dedicated key for each application.
• Test first: Kraken offers a self-service demo for futures, while spot sandbox access is arranged through an account manager. Paper trading on the bot platform is the alternative.
• Confirm that the bot supports your account type (spot or derivatives) before you configure anything.
• Bots do not guarantee profit. They execute rules consistently; the quality of the rules and the risk limits still decide the outcome.

Can you use a bot on Kraken?

Yes. Kraken publishes an API and a list of trading bot and API partners that connect to it, including platforms that offer grid, DCA and signal-driven automation. Developers can also build their own bot on the Kraken API, which gives full control over strategy logic but requires programming and maintenance.

The connection works the same way for almost every third-party platform. You do not hand over your login. You generate an API key pair in your Kraken account, paste it into the bot platform, and the platform sends signed requests to place or cancel orders on your behalf. The key’s permissions define what the bot can and cannot do. That makes the permission step the most important part of the whole setup.

Before you start: what to check

Three checks save most of the problems that appear later.

1. Account type. Kraken Pro is an advanced trading interface rather than a separate subscription, and a bot platform may support Kraken spot, Kraken derivatives, or both. Confirm which account type a platform supports before connecting. A bot configured for one market may lack permissions or compatibility for another, such as futures or margin.
2. Account verification. Your Kraken account needs to be funded and verified to the level required for the markets you want to trade. Check Kraken’s own account pages for the current requirements in your country.
3. Where the bot runs. A hosted platform trades from its own servers, which usually have fixed IP addresses you can whitelist. A self-hosted bot runs from your machine or VPS, so you need a stable address of your own.

Step 1: Create the API key with minimum permissions

Kraken’s documentation applies the principle of least privilege: enable only the scopes the bot needs and avoid the Withdraw Funds permission for any third-party trading software. Everything else follows from this rule.

In your Kraken account, open the Security section, choose API, and add a key. Name it after the application, for example “darkbot-spot”, so you can identify and revoke it later. Kraken’s Quickstart says a programmatic trading setup needs Query Funds, Query Open Orders & Trades, and Create & Modify Orders. Many bots also need permission to cancel orders, since a bot that cannot cancel cannot manage its own positions. Match the list to what your bot platform asks for, and nothing beyond it.

A trade-only key cannot withdraw funds, but it can still place damaging trades, as one security explainer notes. Least privilege limits the worst case; it does not remove risk. That is why the next two steps matter.

Kraken shows the private key only once. Store it in a password manager immediately. If you lose it, generate a new key rather than looking for the old one.

Step 2: Restrict the key to specific IP addresses

IP whitelisting ties the key to the server addresses you list. Kraken describes it as a control that significantly reduces the impact of key exposure, because a stolen key is useless from any other address. The Quickstart also says production keys should be restricted to specific IP addresses.

In practice:

• With a hosted platform, copy the list of IP addresses the platform publishes and enter them in the key’s restriction field.
• With a self-hosted bot, use the static address of your server. A home connection with a changing address will cause the bot to lose access without warning.
• If the platform does not publish fixed addresses, weigh that when choosing it.

Darkbot has covered how IP restrictions and key handling fit together in more detail, and a broader view of API key security in automated trading is worth reading before you create your first key.

Step 3: Connect the key to the bot

Open the exchange connection page of your bot platform, select Kraken, and paste the API key and private key. Then check three things:

1. The platform reports a successful connection and reads your balance correctly.
2. The permissions it reports match the ones you granted.
3. The market type (spot or futures) selected in the bot matches the one the key was created for.

Use a dedicated key for each application. Sharing one key across different software can cause nonce synchronization problems, and separate keys also let you revoke one tool without disturbing the others.

Fixing the invalid nonce error

The most common connection failure on Kraken is EAPI:Invalid nonce. It appears when the nonce in a request is not strictly greater than the last one recorded for that key. Kraken’s error documentation recommends a monotonically increasing integer, such as a millisecond Unix timestamp. If several systems must share a key, Kraken’s developers advise synchronizing nonces with a mutex-protected counter. For most users the simpler fix is one key per application.

Step 4: Configure the strategy and risk limits

Before the bot can trade, it needs rules. The strategy defines when to enter and exit; the risk settings define what the bot may never do. Define both in writing before you touch the interface.

Strategy. Common automated approaches on Kraken include grid, dollar-cost averaging (DCA) and signal- or alert-driven bots. Each depends on market conditions. A grid fits a ranging market and can accumulate losing inventory in a sustained trend. DCA lowers the effect of timing but increases exposure to an asset that keeps falling. Choose the logic whose failure mode you can accept. Our guide to automated trading strategies compares these approaches, and customizing a bot’s parameters covers the settings in detail.

Risk limits. At minimum, decide:

• the maximum capital allocated to the bot, separate from the rest of your balance;
• the maximum size of a single order as a share of that allocation;
• a stop condition that halts the bot, not only a stop on individual trades;
• the pairs the bot may trade, which keeps it away from thin markets where slippage is large.

Fund the Kraken account for the bot with only what you set aside for it. The API key cannot withdraw, but the bot can still trade whatever balance it can see.

Step 5: Test before using real funds

A configuration that has not been tested is an assumption. Kraken’s developer documentation states that for futures you can use the self-service demo environment at demo-futures.kraken.com, while sandbox access for spot is available on request through an account manager. Most individual spot traders will not have an account manager, so the practical route for spot is paper trading or simulation on the bot platform itself.

What to verify during the test:

• Order behavior. Orders appear at the intended price and size, and cancel when they should.
• Rule behavior. The bot reacts to a falling market the way your risk rules say it should, including the stop condition.
• Error handling. Try a revoked key or a missing permission and see how the bot reports it.
• Fees. Compare the fee tier on your Kraken account with the fees your strategy implies. A high-frequency grid with small spacing can lose its margin to fees. Check Kraken’s current fee schedule rather than relying on a figure from a guide.

Suggestion from industry reviewers is consistent: prefer bots with documented demo or simulation features while you are learning how a strategy behaves. When live trading begins, start with a small allocation, and increase it only after the bot has behaved as designed over a meaningful period, including a volatile one.

How to compare Kraken-compatible bots

Kraken’s own partner page lists several platforms, including 3Commas, Bitsgap, Cornix and HaasOnline, with notes on which Kraken markets each one supports. Cornix, for instance, is listed there as supporting Kraken spot. Rather than ranking names, compare any platform on these criteria:

A platform that fails the key handling row should be ruled out whatever its strategy library looks like.

Our perspective

We build Darkbot as an automation platform, not a signal provider. It does not tell you what the market will do. It executes rules you define, the same way each time, and applies risk controls without the delays and hesitation of manual trading.

That shapes how we think about a Kraken setup. The valuable parts are process, not prediction: a key with limited scope, a restricted IP list, a written risk limit, and a test period before capital is at stake. Machine learning, in our use, evaluates patterns probabilistically and adjusts within the rules you set. It does not forecast prices and it does not remove the possibility of loss.

We also prefer human oversight. A bot should be easy to pause, easy to audit and easy to disconnect by revoking a key. If a setup depends on trust you cannot withdraw, it is built the wrong way around. Our articles on risk management in trading bots and the risks traders often miss set out the reasoning in more depth.

— Grisha

Using Darkbot with an exchange account

Darkbot connects to exchanges through API keys, supports strategy customization, backtesting and paper trading, and can run multiple bots at the same time. Before you subscribe, confirm in the exchange list inside the platform that your Kraken market type is supported. The same API-key principles from this guide apply to any exchange you connect.

The plans are published on the Darkbot pricing page: a Free plan with limited features, Standard at $12.50 per month, Premium at $25.00 per month, and an Enterprise option. The Free plan is a reasonable place to run a first paper-trading test. Paid subscriptions carry a 14-day money-back guarantee. For the general workflow, see our bot setup walkthrough.

Are trading bots profitable, and what are the risks?

No bot guarantees profit. The risks fall into three groups: strategy failure (rules that suit one market condition and fail in another), operational errors (wrong permissions, expired keys, connectivity problems), and market volatility. Reviewers recommend restricted permissions, IP whitelisting and simulation as the main ways to manage them. One security explainer calls IP whitelisting the strongest single control available for API keys.

A bot improves consistency of execution. It cannot make a weak strategy sound. Treat results as something to measure over time against your risk limits, not as an expectation. Our overview of automating crypto trading efficiently explains where automation helps and where it does not.

FAQ

Can I use a bot on Kraken?

Yes. Kraken offers an API and lists third-party bot platforms that connect to it. You create an API key with limited permissions, add it to the bot platform, and the platform places orders within those permissions. Check that the platform supports your account type, spot or futures.

Can I use ChatGPT to create a trading bot?

A language model can help draft code that calls the Kraken API, but you remain responsible for reviewing it, handling errors and nonces, and testing it in a demo or paper environment. Never paste your private API key into a chat. Rules on automated trading differ by country, so check the regulations where you live or ask a qualified professional.

Which permissions should a Kraken bot key have?

Only those the bot needs: typically Query Funds, Query Open Orders & Trades, and Create & Modify Orders, plus order cancellation if the bot requires it. Never enable Withdraw Funds. Add IP restrictions to the key as well.

How do I test a Kraken bot without risking money?

For futures, use Kraken’s demo environment. For spot, sandbox access is available through an account manager, so most traders use paper trading on the bot platform. Start live trading with a small allocation only after the test behaves as intended.

Sources

• API key permissions, Kraken Developers
• Quickstart, Kraken Developers
• Error messages, Kraken Developers
• Exchange overview, Kraken Developers
• Trading bot partners, Kraken Support
• Best Trading Bots for Kraken in 2026, TradingBotExperts
• API Keys in Crypto, CoinPaprika
• EAPI:Invalid nonce with Kraken, ccxt issue 5846

Recommended

• API Key Integration: Simplifying Crypto Bot Automation
• What Is API Key Security in Automated Crypto Trading