Broker API HubMenu

Bitget login

messageloginBitget WebSocket APIWebSocketConnection

Logs a WebSocket connection in, so that private channels can be subscribed to. It carries the API key, its passphrase, a timestamp and a signature of that timestamp made with the secret key. Bitget says a failed login disconnects the connection.

Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.

Independent and unofficialbitget.comchecked

This is a message of the Bitget WebSocket API, not an HTTP endpoint. It has no method and no path: it is sent as JSON over an open WebSocket connection.

The signature is the Base64 of an HMAC SHA256, keyed with the secret key, over the timestamp followed by GET and /user/verify. The page also describes an RSA variant. It says the request expires 30 seconds after the timestamp. The page is not consistent about the unit: its text says Unix time in milliseconds, while its Java step divides milliseconds by 1000 and its request example holds a ten digit value.

The message

Name
login
Direction
Request, sent by the client
Carried by
WebSocket. Login is sent on the private connection. The addresses are the ones on Bitget's quick start page (bitget.com/docs/uta/quick-start), opened the same day, which also lists VIP and low latency hosts.
Private channel
wss://ws.bitget.com/v3/ws/private
Private channel, demo trading
wss://wspap.bitget.com/v3/ws/private

Fields

The vendor's page does not say which of these fields are required or always present.

NameTypeDescription
opNot statedAlways login.
argsNot statedA list with one object, holding the four fields below.
args[].apiKeyNot statedThe API key.
args[].passphraseNot statedThe passphrase set when the API key was created.
args[].timestampNot statedThe time the request is made, as Unix time. See the note on its unit.
args[].signNot statedThe signature of the timestamp, worked out as the note describes.

What arrives

login: On success, a message whose event is login and whose code is 0. On failure, a message whose event is error with a code, 30005 in the page's example.

The vendor's page does not say which of these fields are required or always present.

NameTypeDescription
eventNot statedlogin on success, error on failure.
codeNot stated0 on success. An error code otherwise.
msgNot statedEmpty on success in the page's example.

Sample

Written by this site from the fields recorded on this page. It has not been run against a terminal, a server or an account, and the values in it are placeholders. No credential is typed into it: where a field holds one, the placeholder says where it comes from. Nothing is entered on this site.

{
  "op": "login",
  "args": [
    {
      "apiKey": "<your API key, from your own environment>",
      "passphrase": "<the passphrase of the key, from your own environment>",
      "timestamp": "<the current Unix time>",
      "sign": "<the signature, worked out in your own code from the secret key>"
    }
  ]
}

Limits that apply at Bitget

LimitValueScopeSource
Public market data, legacy v1 API20 per 2 s per IP, public market dataPer IP address, public market data endpoints of the legacy v1 APIbitgetlimited.github.iochecked
Overall requests a minute6,000Per IP address, all requests to the common domain name, with REST and WebSocket sharing one allowancebitget.comchecked
Concurrent WebSocket connections100Per IP addressbitget.comchecked
WebSocket messages a second10Per WebSocket connection, counting ping, login, subscribe and unsubscribe messagesbitget.comchecked
WebSocket subscription requests an hour240Per WebSocket connectionbitget.comchecked
Concurrent WebSocket channel subscriptions1,000Per WebSocket connectionbitget.comchecked