Bybit — read-only API key
HMAC key, read-only, with Unified Trading and Assets read scopes enabled. You create the key on bybit.com / bybit.eu; it takes a couple of minutes.
- You will end up with
- API key · Secret
Log in to bybit.com — or bybit.eu if your account is on the European platform.
Go to Account, then API.
Click Create New Key.
Select System generated API keys.
Warning: Choose the HMAC option, not self-generated RSA keys. Preuval signs requests with HMAC-SHA256; an RSA key will fail to authenticate.
Select API Transaction as the usage type.
Set a name — for example "preuval".
Select Read-only (shown as "Alleen-lezen" on a Dutch-language account).
Select No IP restriction ("Geen IP-beperking").
Under permissions, check Trade under Unified Trading, and check Assets.
Warning: These scopes decide which history the key may READ — the key stays read-only and cannot place orders. Without them every history request comes back "Permission denied" (retCode 10005), even though the key itself is valid.
Click Submit and complete 2FA.
Copy the API key and secret.
Warning: The secret is displayed once and never again. Copy it before closing the dialog — if you lose it you have to delete the key and start over.
In Preuval: select Bybit (or Bybit EU), set the environment to Production, and paste the key and secret. Bybit does not use a passphrase.
Warning: If your account lives on bybit.eu, you must pick Bybit EU. Bybit issues keys per platform: a bybit.eu key authenticates only against api.bybit.eu and returns 401 Unauthorized anywhere else.
Save the credentials somewhere safe
Copy each value into a password manager as the exchange shows it. Secrets are displayed once, and a half-copied secret fails authentication in a way that looks identical to a wrong one. Preuval never writes your keys to disk — they are used for the run and discarded.
If verification fails
- 401 Unauthorized — the key is being sent to the wrong platform. A bybit.eu key needs the Bybit EU option; a bybit.com key needs plain Bybit.
- retCode 10005, "Permission denied" — the key is valid but missing scopes. Edit it on Bybit and enable read access for Unified Trading and Assets.
- retCode 10003, "API key is invalid" — the key was deleted, or belongs to a different platform than the one selected.