“API keys do not have the required permissions”
This is what the bot answers while you are creating an exchange bot if the key pair has the right format but the exchange does not allow it to trade. The full text is “API keys do not have the required permissions”. For a bot that is already running the same problem sounds different: “Your API key is invalid or lacks required permissions. Update API keys according to the instructions” or “The API key has no permission for this operation”.
What it means
The key exists and the exchange recognizes it, but when the key was issued on Bybit the permissions needed for orders and positions were not ticked. The message does not say which permission exactly is missing.
Why it happens
| Bot type | Permission needed on Bybit |
|---|---|
| Bybit Spot | Spot Trading |
| Bybit Futures | Derivatives / Contract Trading (orders and positions) |
Typical reasons:
- the key was issued read-only, without the right to trade;
- spot and futures need two different key pairs — a spot key is connected to a futures bot or the other way round;
- the key permissions were changed on Bybit after the bot was connected;
- the key belongs to a copy-trading master account — such a key is rejected separately: “This API key belongs to a copy-trading master account. All your Grid/DCA orders would be automatically copied to your followers. Please use a regular account without copy-trading.”
The bot does not need the withdrawal permission — do not enable it.
What to do
- Open API key management on Bybit and check the permissions. The simplest way is to issue a new key with the permission from the table above, without the withdrawal right.
- Copy the key and the secret in full, without extra spaces.
- If the bot is not created yet — send the new pair in the creation wizard: the key and the secret in one message, separated by a space.
- If the bot already exists — bot card → Bot settings → Update API keys, and send the new pair the same way, separated by a space.
- The warning “API key without IP whitelist” is not an error: the bot works without the IP restriction too, this is a security recommendation.
The same key pair cannot be linked to two bots — the bot answers “This API key pair already exists in the system”. Issue a separate pair for the second bot.
When to contact support
If the key was issued with the right permission, the pair has been updated, and the bot still answers about permissions — write to support: give the bot name and its type (Spot or Futures). Never forward the key secret to anyone.