Retrieve OAuth API key secret
curl --request GET \
--url https://whitebit.com/oauth2/api-key/{externalId}/secret \
--header 'Authorization: Bearer <token>'import requests
url = "https://whitebit.com/oauth2/api-key/{externalId}/secret"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://whitebit.com/oauth2/api-key/{externalId}/secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://whitebit.com/oauth2/api-key/{externalId}/secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://whitebit.com/oauth2/api-key/{externalId}/secret"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://whitebit.com/oauth2/api-key/{externalId}/secret")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://whitebit.com/oauth2/api-key/{externalId}/secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": {
"apiSecret": "YOUR_API_SECRET"
}
}{
"data": {
"message": [
"Unauthorized."
]
}
}{
"data": {
"message": [
"Forbidden."
]
}
}{
"data": {
"message": [
"Key not found."
]
}
}{
"data": {
"message": [
"Secret already retrieved."
]
}
}{
"data": {
"message": [
"Temporary lock, retry shortly."
]
}
}Retrieve OAuth API key secret
Retrieve the API secret for a partner-issued OAuth API key once. The secret is unrecoverable after retrieval.
GET
/
oauth2
/
api-key
/
{externalId}
/
secret
Retrieve OAuth API key secret
curl --request GET \
--url https://whitebit.com/oauth2/api-key/{externalId}/secret \
--header 'Authorization: Bearer <token>'import requests
url = "https://whitebit.com/oauth2/api-key/{externalId}/secret"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://whitebit.com/oauth2/api-key/{externalId}/secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://whitebit.com/oauth2/api-key/{externalId}/secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://whitebit.com/oauth2/api-key/{externalId}/secret"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://whitebit.com/oauth2/api-key/{externalId}/secret")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://whitebit.com/oauth2/api-key/{externalId}/secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": {
"apiSecret": "YOUR_API_SECRET"
}
}{
"data": {
"message": [
"Unauthorized."
]
}
}{
"data": {
"message": [
"Forbidden."
]
}
}{
"data": {
"message": [
"Key not found."
]
}
}{
"data": {
"message": [
"Secret already retrieved."
]
}
}{
"data": {
"message": [
"Temporary lock, retry shortly."
]
}
}Authentication
OAuth 2.0 Bearer token. Required scope:apikeys.read. See Authentication. The endpoint is available on https://whitebit.com only.
Cache
No caching. The response carriesCache-Control: no-store.
Notes
Store the API secret in encrypted backend storage on first retrieval. The secret is not recoverable after this call returns.
409 Conflict. Recovery from 409 requires deleting the key via Delete OAuth API key and restarting the OAuth API key flow to issue a new key — the secret cannot be re-issued for an existing key.
A 423 Locked response indicates a concurrent secret-retrieval attempt against the same key. Retry the request after a short delay. Use exponential backoff starting at 5–10 seconds, doubling per attempt, capped at 60 seconds, with a total budget of 3–5 minutes. The platform does not currently send a Retry-After header.
- Obtain the
externalIdpath parameter from Check OAuth API key existence. - The endpoint does not return the public
apiKeystring. The WhiteBIT frontend delivers the publicapiKeyto the partner at consent completion. [PENDING: confirm with the WhiteBIT frontend team where exactly the partner receives the publicapiKey(callback parameter name and URL location) — update this note with the wire-level details once confirmed.]
Authorizations
OAuth 2.0 Bearer Token authentication. Include the access token in the Authorization header.
Example: Authorization: Bearer YOUR_ACCESS_TOKEN
Path Parameters
External UUID of the API key. Obtain the value from GET /oauth2/api-key/info.
Example:
"550e8400-e29b-41d4-a716-446655440000"
Response
Successful response. The secret is returned exactly once.
Show child attributes
Show child attributes
Was this page helpful?