Retrieve OAuth API key secret
curl --request GET \
--url https://whitebit.com/oauth2/api-key/{externalId}/secret \
--header 'Authorization: Bearer <token>'import requests
url = "https://whitebit.com/oauth2/api-key/{externalId}/secret"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://whitebit.com/oauth2/api-key/{externalId}/secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://whitebit.com/oauth2/api-key/{externalId}/secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://whitebit.com/oauth2/api-key/{externalId}/secret"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://whitebit.com/oauth2/api-key/{externalId}/secret")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://whitebit.com/oauth2/api-key/{externalId}/secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": {
"apiSecret": "YOUR_API_SECRET"
}
}{
"data": {
"message": [
"Unauthorized."
]
}
}{
"data": {
"message": [
"Forbidden."
]
}
}{
"data": {
"message": [
"Key not found."
]
}
}{
"data": {
"message": [
"Secret already retrieved."
]
}
}{
"data": {
"message": [
"Temporary lock, retry shortly."
]
}
}Retrieve OAuth API key secret
The endpoint retrieves the API secret for a partner-issued API key. The endpoint returns the secret exactly once per key — a subsequent call returns 409 Conflict.
Required scope: apikeys.read.
Region availability: The endpoint is available on the global server (https://whitebit.com) only.
Store the API secret in encrypted backend storage on first retrieval. The secret is not recoverable after this call returns.
GET
/
oauth2
/
api-key
/
{externalId}
/
secret
Retrieve OAuth API key secret
curl --request GET \
--url https://whitebit.com/oauth2/api-key/{externalId}/secret \
--header 'Authorization: Bearer <token>'import requests
url = "https://whitebit.com/oauth2/api-key/{externalId}/secret"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://whitebit.com/oauth2/api-key/{externalId}/secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://whitebit.com/oauth2/api-key/{externalId}/secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://whitebit.com/oauth2/api-key/{externalId}/secret"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://whitebit.com/oauth2/api-key/{externalId}/secret")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://whitebit.com/oauth2/api-key/{externalId}/secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": {
"apiSecret": "YOUR_API_SECRET"
}
}{
"data": {
"message": [
"Unauthorized."
]
}
}{
"data": {
"message": [
"Forbidden."
]
}
}{
"data": {
"message": [
"Key not found."
]
}
}{
"data": {
"message": [
"Secret already retrieved."
]
}
}{
"data": {
"message": [
"Temporary lock, retry shortly."
]
}
}Authentication
OAuth 2.0 Bearer token. Required scope:apikeys.read. See Authentication. The endpoint is available on https://whitebit.com only.
Cache
No caching. The response carriesCache-Control: no-store.
Notes
Store the API secret in encrypted backend storage on first retrieval. The secret is not recoverable after this call returns.
409 Conflict. Recovery from 409 requires deleting the key via Delete OAuth API key and restarting the OAuth API key flow to issue a new key — the secret cannot be re-issued for an existing key.
A 423 Locked response indicates a concurrent secret-retrieval attempt against the same key. Retry the request after a short delay. Use exponential backoff starting at 5–10 seconds, doubling per attempt, capped at 60 seconds, with a total budget of 3–5 minutes. The platform does not currently send a Retry-After header.
- Obtain the
externalIdpath parameter from Check OAuth API key existence. - The endpoint does not return the public
apiKeystring. The WhiteBIT frontend delivers the publicapiKeyto the partner at consent completion. [PENDING: confirm with the WhiteBIT frontend team where exactly the partner receives the publicapiKey(callback parameter name and URL location) — update this note with the wire-level details once confirmed.]
Used in these guides
- Copy Trading — mirror a lead trader’s orders into followers’ own accounts via OAuth-issued keys.
- Fast API Key integration — OAuth-issued API keys created on behalf of end users.
Authorizations
Path Parameters
Was this page helpful?