API Base URL (private / account endpoints): https://api.bitlo.com
API Base URL (public market data & WebSocket feed): https://api4.bitlo.com
API Base URL (Kline / candlestick history): https://api3.bitlo.com
For GET endpoints, parameters must be sent as a query string.
For POST endpoints, parameters must be sent as a JSON object in the request body.
All endpoints return a JSON object.
Market pairs are referenced using the BASE-QUOTE format, e.g. BTC-TRY.
Authentication
All Private API endpoints (which are related to a user account) require authentication.
Below are the required parameters for authenticating a request:
x-pubkey: API Public Key
x-nonce: Nonce
x-signature: Signature
Note
Please reach out to Customer Support or send an email to destek@bitlo.com to receive instructions on how to generate your API key.
Nonce
The nonce is an integer equal to the current timestamp in milliseconds.
You must keep your local clock in sync with the Bitlo API server time. A request is only accepted if its nonce is within ±2 minutes of the server time; otherwise it is rejected as an invalid nonce. Our servers use the UTC timezone. You can check the current server time here.
Signature
The signature is an HMAC-SHA256 hash of the message publicKey + nonce (your API public key concatenated with the nonce), keyed with your API secret. The resulting hash must be hex-encoded in lowercase and sent in the x-signature header.
Warning
Use your API secret as-is (its raw bytes) for the HMAC key, and output the signature as a lowercase hex string. Do not Base64-decode the secret, and do not Base64-encode the signature — doing either will cause signature verification to fail.
When a request fails, the API responds with an appropriate HTTP status code (for example 400 for an invalid request, or 401 / 403 for authentication problems) and a JSON body describing the error:
{"code":123,"message":"A human-readable description of the error.","timestamp":"2024-02-05T08:17:18.388Z"}
code — Bitlo-specific error code.
message — Human-readable explanation of the error.
timestamp — Server time (UTC) at which the error occurred.
Common authentication failures (missing or invalid x-pubkey / x-nonce / x-signature, an out-of-range nonce, or a signature mismatch) are returned as HTTP 401 / 403 errors in this same format.
This endpoint provides information about the last trade (tick), best bid/ask, last 24 hours lowest/highest quotes and volume data for the given market.
This endpoint lists the current open orders for the customer. Once an order is no longer open (for example, it has been settled or cancelled), it no longer appears in the response.
If the market parameter is provided, only the open orders for the given market are returned. Otherwise, all open orders are returned.
This endpoint requires authentication. Please check Authentication section for details.
This endpoint lists all orders (open, partially filled, filled or cancelled) for the customer.
If the market parameter is provided, only the orders for the given market are returned. Otherwise, all orders are returned.
This endpoint requires authentication. Please check Authentication section for details.
importorg.springframework.messaging.converter.MappingJackson2MessageConverter;importorg.springframework.messaging.simp.stomp.StompSession;importorg.springframework.web.socket.messaging.WebSocketStompClient;importorg.springframework.web.socket.sockjs.client.RestTemplateXhrTransport;importorg.springframework.web.socket.sockjs.client.SockJsClient;importorg.springframework.web.socket.sockjs.client.Transport;importjava.util.concurrent.TimeUnit;publicclassStompClient{privateStringurl;publicstaticlonglastMessageTime=0;SockJsClientclient;privatefinalStompSocketHandlermyWebSocketHandler;WebSocketStompClientstompClient;privatefinalStompSessHandlersessionHandler;StompSessionstompSession;publicStompClient(StompSessHandlersessionHandler,StompSocketHandlermyWebSocketHandler,Stringurl){this.sessionHandler=sessionHandler;this.myWebSocketHandler=myWebSocketHandler;this.url=url;connect();}publicvoidconnect(){log.info("Start connecting to url : "+url);List<Transport>transports=newArrayList<>(1);transports.add(newRestTemplateXhrTransport());client=newSockJsClient(transports);stompClient=newWebSocketStompClient(client);stompClient.setMessageConverter(newMappingJackson2MessageConverter());try{stompSession=stompClient.connect(url,sessionHandler).get(60,TimeUnit.SECONDS);log.info("Socket connected...");}catch(InterruptedException|ExecutionException|TimeoutExceptione){log.error("Socket connection error",e);}}}importorg.springframework.messaging.simp.stomp.StompHeaders;importorg.springframework.messaging.simp.stomp.StompSession;importorg.springframework.messaging.simp.stomp.StompSessionHandlerAdapter;publicclassStompSessHandlerextendsStompSessionHandlerAdapter{@OverridepublicvoidafterConnected(StompSessionsession,StompHeadersconnectedHeaders){System.out.println("New session established : "+session.getSessionId());StompClient.lastMessageTime=System.currentTimeMillis()+60000;session.subscribe("/topic/ticker/*",this);session.subscribe("/topic/market/*",this);System.out.println("All Subscribed.");}@OverridepublicTypegetPayloadType(StompHeadersheaders){switch(headers.getSubscription()){case"0":// tickerreturn<YourTickerObject.class>;case"1":// marketreturn<YourMarketObject.class>;default:returnnull;}}}importorg.springframework.web.socket.WebSocketHandler;importorg.springframework.web.socket.WebSocketSession;publicclassStompSocketHandlerimplementsWebSocketHandler{@OverridepublicvoidafterConnectionEstablished(WebSocketSessionsession)throwsException{System.out.println("Connected");StompClient.lastMessageTime=System.currentTimeMillis()+60000;}@OverridepublicbooleansupportsPartialMessages(){returnfalse;}}
Channel, Event and Model
After connecting to the websocket feed, you need to subscribe to the specific channels you want to receive messages from. (The feed is public, so no login is required.)
You will continue to receive messages from a channel until you send an unsubscribe message for it.
Channel
Description
/topic/ticker
Sends ticker data for all markets. e.g.: /topic/ticker/all
/topic/market
Sends market data updates for the given pair. e.g.: /topic/market/BTC-TRY