How to create a read-only Bitget API key

Open Bitget API Management ↗

We checked these steps against Bitget's own documentation on 25 September 2026. Bitget can rename a button at any time. If a label differs, look for the same permission.

Before you start

• Turn on two-factor authentication or add a phone number in Bitget, because creating a key asks for security codes.

Permissions

Turn on only:

• Classic: Spot (read-only)
• Classic: Futures Orders and Holdings (read-only)
• Unified: Unified account management (read-only)

Keep these off:

• Read and write (trading)
• Unified account trade
• Withdraw
• Transfer
• Margin
• Copy trading

Steps

Sovereign connects to Bitget from one fixed IP address. The connection form in Sovereign shows it next to these steps, with a copy button.

1. Press the button above and log in to Bitget with the account you want to track.
2. Start creating a new API key. If Bitget asks which account it is for, pick the one you want to track.
3. Choose the system-generated key, not “User-generated API Keys”, which Sovereign cannot use.
4. Make up a passphrase: 8 to 32 characters, only letters and numbers, at least one of each. Write it down; it cannot be changed later.
5. If the boxes say Spot and Futures (Classic account), choose read-only, then tick only Spot and both Futures boxes: Orders and Holdings.
6. If you see Unified account management instead (Unified Trading Account), tick only that box and set it to read-only.
7. In the IP address field, paste Sovereign's IP address, and nothing else.
8. Confirm with the security codes Bitget sends you (email, SMS or authenticator app) to create the key.
9. Copy the API key and the secret key Bitget shows now; the secret may not be shown again.
10. Paste the API key, secret key and passphrase into the API KEY, API SECRET and PASSPHRASE fields in Sovereign, then press “Connect & Sync”.

Where each value goes in Sovereign:

• API Key → API KEY
• Secret Key → API SECRET
• The passphrase you made up → PASSPHRASE

Does a Bitget API key expire?

• With an IP restriction: No published expiry rule.
• Without an IP restriction: No published expiry rule.

Bitget publishes no clear expiry rule. If the key stops working, Sovereign marks the connection as expired and asks for a new key.

Each key reads only the account it was made for, so every sub-account needs its own key and its own Sovereign connection. On a Classic account, Earn, margin, copy-trading, bot and funding/P2P balances are not synced. Sovereign reads your futures positions and each futures account’s available and locked balance, never your orders: step 5 asks for both Classic futures boxes because Bitget does not publish which of the two covers positions, and a key missing the right one is refused with error 40014.

If something goes wrong

• If the sync fails with Bitget error 40014 or 40040 (missing permission): create a new key and tick the boxes from step 5 or 6.
• If the sync fails with Bitget error 40038 (IP not allowed): edit the key's IP to Sovereign's IP address; if you can't, create a new key.
• If you forget the passphrase or lose the secret key: delete the key in Bitget and create a new one.
• If Bitget asks you to finish identity verification first: complete it, then come back to the API page.

Sources

• www.bitget.com/docs/uta/quick-start
• www.bitget.com/docs/classic/rest-api
• www.bitget.com/support/articles/12560603795900
• www.bitget.com/docs/classic/error-code/restapi