How to create a read-only Deribit API key

Open Deribit API page ↗

We checked these steps against Deribit's own documentation on 25 September 2026. Deribit can rename a button at any time. If a label differs, look for the same permission.

Before you start

• Use your live Deribit account at www.deribit.com. Keys made on test.deribit.com won't work.
• If your account uses 2FA, have your code or passkey ready.
• Deribit shows the Client Secret only once, so keep this page open and paste it in straight away.

Permissions

Turn on only:

• Account: read
• Trade: read

Keep these off:

• Account: read_write
• Trade: read_write
• Wallet
• Block Trade
• Block RFQ
• Custody

Steps

Sovereign connects to Deribit from one fixed IP address. The connection form in Sovereign shows it next to these steps, with a copy button.

1. Click the button above and log in to your Deribit account at www.deribit.com.
2. Click “Show keys” so your new key appears in the list once you create it.
3. If a “Confirm action” window opens, enter your 2FA code or click “Confirm with Passkey”.
4. Click “ADD NEW KEY”, leave “Deribit-generated key” selected and click “Next”.
5. Set “Account” to “read” and “Trade” to “read”. Leave every other dropdown on “none” and leave “Features” empty.
6. In “Name”, type Sovereign.
7. Paste Sovereign's IP address into the first “IP Whitelist” box. Leave the other boxes empty.
8. Click the “Create a new API key” button at the bottom of the window.
9. If a “Confirm action” window opens, enter your 2FA code or click “Confirm with Passkey”.
10. Copy the new key's “Client ID” and “Client Secret” into the fields of Sovereign's connection form, then press “Connect & Sync”.

Where each value goes in Sovereign:

• Client ID → API KEY
• Client Secret → API SECRET

Does a Deribit API key expire?

• With an IP restriction: No published expiry rule (keys have no expiry setting).
• Without an IP restriction: No published expiry rule (keys have no expiry setting).

Deribit publishes no clear expiry rule. If the key stops working, Sovereign marks the connection as expired and asks for a new key.

Sovereign reads only the account a key was made in, so a main-account key shows just the main account. For each subaccount, switch into it, create a key there and add it as its own connection.

If something goes wrong

• If you don't land on the API page after logging in: open the API section from the account menu at the top right.
• If the new key doesn't appear after you create it: don't make a second one. Click “Show keys”, approve any “Confirm action” window, and find the Sovereign row.
• If Sovereign says the key is invalid: check that the key's IP whitelist has Sovereign's IP address, not your own. Deribit reports a wrong IP the same way as a wrong key.
• If you lost the Client Secret: click “Reset Secret” on that key's row, then use Reconnect in Sovereign to paste the new secret.

Sources

• docs.deribit.com/articles/creating-api-key
• support.deribit.com/hc/en-us/articles/26311157677853-Account-Security-Configurations
• docs.deribit.com/articles/access-scope
• support.deribit.com/hc/en-us/articles/25944616386973-Subaccounts