# Bitget login Independent and unofficial. Not affiliated with or endorsed by any broker or platform named here. Educational only: nothing here is advice, and nothing here recommends a broker or a trade. This is the markdown version of https://openbrokerapi.com/brokers/bitget/messages/login, written from the same records as that page. Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders. Logs a WebSocket connection in, so that private channels can be subscribed to. It carries the API key, its passphrase, a timestamp and a signature of that timestamp made with the secret key. Bitget says a failed login disconnects the connection. - Message: `login` - Interface: Bitget WebSocket API - Group: Connection - Status: verified. Source: [bitget.com](https://www.bitget.com/docs/uta/quick-start#login), checked 2026-10-12. This is a message of the Bitget WebSocket API, not an HTTP endpoint. It has no method and no path: it is sent as JSON over an open WebSocket connection. It is in no OpenAPI file on this site and the request builder does not list it. Note: The signature is the Base64 of an HMAC SHA256, keyed with the secret key, over the timestamp followed by GET and /user/verify. The page also describes an RSA variant. It says the request expires 30 seconds after the timestamp. The page is not consistent about the unit: its text says Unix time in milliseconds, while its Java step divides milliseconds by 1000 and its request example holds a ten digit value. ## The message - Name: `login` - Direction: Request, sent by the client - Carried by: WebSocket. Login is sent on the private connection. The addresses are the ones on Bitget's quick start page (bitget.com/docs/uta/quick-start), opened the same day, which also lists VIP and low latency hosts. - Private channel: `wss://ws.bitget.com/v3/ws/private` - Private channel, demo trading: `wss://wspap.bitget.com/v3/ws/private` ## Fields - `op` (type not stated, required or not: not stated): Always login. - `args` (type not stated, required or not: not stated): A list with one object, holding the four fields below. - `args[].apiKey` (type not stated, required or not: not stated): The API key. - `args[].passphrase` (type not stated, required or not: not stated): The passphrase set when the API key was created. - `args[].timestamp` (type not stated, required or not: not stated): The time the request is made, as Unix time. See the note on its unit. - `args[].sign` (type not stated, required or not: not stated): The signature of the timestamp, worked out as the note describes. ## What arrives `login`: On success, a message whose event is login and whose code is 0. On failure, a message whose event is error with a code, 30005 in the page's example. - `event` (type not stated, required or not: not stated): login on success, error on failure. - `code` (type not stated, required or not: not stated): 0 on success. An error code otherwise. - `msg` (type not stated, required or not: not stated): Empty on success in the page's example. ## Sample Written by this site from the fields recorded on this page. It has not been run against a terminal, a server or an account, and the values in it are placeholders. No credential is typed into it: where a field holds one, the placeholder says where it comes from. Nothing is entered on this site. ```json { "op": "login", "args": [ { "apiKey": "", "passphrase": "", "timestamp": "", "sign": "" } ] } ``` ## Limits that apply at Bitget - Public market data, legacy v1 API: 20 per 2 s per IP, public market data - Scope: Per IP address, public market data endpoints of the legacy v1 API - Status: verified. Source: [bitgetlimited.github.io](https://bitgetlimited.github.io/apidoc/en/spot/), checked 2026-10-12. - Note: Re-read on the legacy v1 documentation on 12 Oct 2026: 20 requests in 2 seconds. Authenticated endpoints there are set per endpoint per UID, and a general endpoint with no figure of its own is 10 a second. HTTP 429 on breach. The window is 2 seconds, which a single unit cannot state, so the figure stays as wording. The current API states its own overall limit, held in a separate record. - Overall requests a minute: 6,000 requests per minute - Scope: Per IP address, all requests to the common domain name, with REST and WebSocket sharing one allowance - Status: verified. Source: [bitget.com](https://www.bitget.com/docs/uta/quick-start), checked 2026-10-12. - Note: Each endpoint also carries its own limit on its own documentation page, counted separately. HTTP 429 on breach. - Concurrent WebSocket connections: 100 connections - Scope: Per IP address - Status: verified. Source: [bitget.com](https://www.bitget.com/docs/uta/quick-start), checked 2026-10-12. - Note: Also 300 connection requests per IP in 5 minutes. - WebSocket messages a second: 10 messages per second - Scope: Per WebSocket connection, counting ping, login, subscribe and unsubscribe messages - Status: verified. Source: [bitget.com](https://www.bitget.com/docs/uta/quick-start), checked 2026-10-12. - Note: A connection that sends more is disconnected, and an IP that is disconnected repeatedly may be blocked. - WebSocket subscription requests an hour: 240 subscription requests per hour - Scope: Per WebSocket connection - Status: verified. Source: [bitget.com](https://www.bitget.com/docs/uta/quick-start), checked 2026-10-12. - Concurrent WebSocket channel subscriptions: 1,000 channel subscriptions - Scope: Per WebSocket connection - Status: verified. Source: [bitget.com](https://www.bitget.com/docs/uta/quick-start), checked 2026-10-12. - Note: Bitget recommends fewer than 50 channels on one connection. ## Related Bitget messages: Connection - [ping](https://openbrokerapi.com/brokers/bitget/messages/ping): Keeps a connection alive. It is the plain string ping, not JSON, and the server answers with the string pong. Bitget recommends sending it every 30 seconds and says the server disconnects after 2 minutes without one. ## More on Bitget - [All Bitget messages](https://openbrokerapi.com/brokers/bitget/messages): 10 documented here, grouped by what they do. - [Log in and keep a session: the call at each API](https://openbrokerapi.com/endpoints/session): The same job at every broker and platform API recorded here, HTTP or not. - [Bitget API page](https://openbrokerapi.com/brokers/bitget): The full record: access, authentication, limits and the source for each. ## Licence and how to cite The records behind this page are all rights reserved. This file is the page itself, at its own address, in another format. It is not part of the CC BY 4.0 downloads listed at https://openbrokerapi.com/data. Quote from it with a link to the page. Cite as: Bitget login. Broker API Hub, https://openbrokerapi.com/brokers/bitget/messages/login, newest check 2026-10-12. Where you rely on a single figure, cite the source and the checked date printed beside it as well. Where this page and a broker's own documentation differ, the documentation wins.