API Trading Software: Check the Exchange Limits First

Most people choose API trading software in the wrong order. They compare Freqtrade against a hosted grid bot, argue about which has more strategy templates, and only open the exchange documentation after the code is written — at which point they discover the order endpoint's rate limit cannot absorb their signal frequency.

Reverse it. Settle what the exchange API actually permits — key permissions, how rate limits are counted, whether a demo environment exists — and the software choice mostly answers itself.

This piece covers three things: the three categories of API trading software and who each suits, the exchange-side parameters that will stall a strategy regardless of how good it is, and the full connection path to the WEEX spot and futures APIs. Interface details below come from the WEEX API documentation, V3(BETA), checked 5 August 2026.

What API Trading Software Actually Does — and Doesn't

API trading software does not hold your money and does not match trades. It pulls market data, computes a signal from your rules, and pushes orders through the exchange's REST or WebSocket endpoints. Assets stay in your exchange account. The software holds only a permission-scoped key.

That division of labour gives you two hard filters. First, any product that asks you to deposit funds into a "platform account" so it can trade for you is not API trading software — it is custody, and the risk profile is entirely different. Second, no bot can exceed what the exchange exposes. If the endpoint doesn't exist, the feature doesn't exist.

WEEX splits its interfaces into five tracks — spot, futures, partner, broker and copy trading. Spot and futures are the two that matter for most quant users; the WEEX API overview page lists programmatic access across 100+ digital currencies.

Open Source, Cloud Bot, or Custom Engine

Every option falls into one of three buckets. The real difference is not strategy count — it is how much engineering you are willing to own.

A few rules of thumb. For low-frequency trend or grid strategies, a cloud bot is enough — the time you save is worth more than the subscription you pay. For multi-asset, multi-timeframe or custom-indicator work, open source wins on economics, and the size of the Freqtrade and Hummingbot communities means most failure modes are already documented. Building your own is only justified when latency is itself a source of return: high-frequency market making, cross-venue arbitrage.

One point deserves more weight than it usually gets. Giving a cloud platform your API key is not giving away your funds, but it is giving away order authority. In the worst case a compromised or dishonest operator can trade your balance against you in a thin pair. So: trade permission only, IP whitelist on, and never expose an account's entire balance to a single third-party key.

Rate Limits Decide Whether Your Strategy Survives

This is the step most often skipped during selection and most often fatal after launch. A rate limit is not one number — it is two independent counters, and confusing them means getting rejected exactly when you most need to trade.

The WEEX spot Access Restrictions documentation is explicit:

Details worth writing directly into your code: endpoint weights vary, with resource-heavy calls costing more; every response carries X-USED-WEIGHT-1M and X-REMAINING-WEIGHT-1M style headers so you can measure headroom instead of guessing; exceeding a limit returns HTTP 429 and a 10s ban. Order requests carry their own X-ORDER-COUNT- and X-ORDER-REMAINING- headers.

Ten seconds sounds trivial. For a strategy trying to place a stop, ten seconds is enough to double the drawdown. The deeper problem is usually not the ban itself but software that treats 429 as an ordinary failure, retries into the ban window, and keeps renewing it. Any API trading software heading to production should read both header groups before it places its first live order.

Futures rate limits are documented separately under the futures API — check those figures there rather than assuming the spot numbers carry over.

Connecting API Trading Software to WEEX in Five Steps

1. Create the key. Log in, open Account → API Management, select Create API Key and complete the security verification. Each user can hold up to 10 API key groups.
2. Scope the permissions. New keys default to Read Only. Programmatic trading requires manually selecting the relevant trade permission (Spot). If you are only backtesting or monitoring, leave it read-only — the cheapest insurance available.
3. Store the three secrets. You receive an APIKey, a SecretKey and a Passphrase. The Passphrase is user-defined and cannot be recovered; losing it means creating a new key. Any one of the three leaking can cost you assets, so delete a compromised key immediately.
4. Bind an IP. Keys can be bound to IP addresses at creation. An unbound key, once leaked, works from anywhere. This takes fifteen seconds and has the best security return of anything on this list.
5. Set the domain and signing. Spot REST runs on https://api-spot.weex.com, futures on https://api-contract.weex.com. Every request carries ACCESS-KEY, ACCESS-SIGN, ACCESS-PASSPHRASE and ACCESS-TIMESTAMP. Full flow in the spot API preparation guide.

The table below is the parameter sheet worth copying before you integrate. Verified 5 August 2026 against WEEX API documentation V3(BETA).

Test on the Demo Endpoints Before Real Money

A clean backtest proves the strategy logic. It proves nothing about the integration: whether your signature is correct, whether timestamp drift gets you rejected, whether error codes parse, whether the process recovers after a disconnect. None of that affects whether a strategy is profitable, and all of it can lose money on day one.

WEEX futures exposes a set of demo trading endpoints under /capi/v3/sim/, covering balance, order placement, positions and order history. Same authentication, same rate-limit behaviour, fake money — the demo balance returns as SUSDT rather than USDT.

Treat it as a pre-launch CI gate: after any code change, run a full trading day in the demo environment and confirm there are no duplicate orders, no accumulating 429s, and that position state matches the exchange after a forced reconnect. The debugging time this saves usually exceeds whatever the strategy optimisation was worth.

Four Ways API Trading Software Loses Money

Over-scoped keys. Ticking every permission and skipping the IP binding, because it's faster. The rule is simple: a spot-only strategy gets no futures permission; a monitoring script stays read-only.

Treating 429 as a normal error. Not reading the headroom headers, then retrying through the ban and extending it. This happens most reliably during violent moves — exactly when you need to place orders.

Stops that live only in your script. If the process crashes or the server loses connectivity, a local stop-loss does not exist. Futures supports server-side conditional and take-profit/stop-loss orders. Put protective orders on the exchange, not inside your Python process's lifespan.

Backtesting at perfect fills. Backtests fill at the close; live trading pays spread, slippage and depth. The more a strategy relies on high-frequency small edges, the larger that leakage looms — and on thin altcoin pairs it can consume the whole edge. A grid strategy showing 80% annualised in backtest needs a small live allocation before you know what's left.

Settle the Interface Questions Before You Pick Software

Back to the opening point. The question to answer first is not which API trading software has more features, but three interface questions: can this exchange's order rate limit absorb my signal frequency, can key permissions be cut to the minimum, and is there a demo environment to validate against before going live? Once those are settled, the rest — open source or hosted, Python or otherwise — is a matter of preference.

WEEX covers market data, account, trading and WebSocket streaming across spot and futures, with demo endpoints and server-side conditional orders on the futures side and isolated keys for copy trading. A sensible starting point is to create a read-only key from the WEEX API page, get market data flowing, and widen permissions only once the plumbing works.

FAQ

1. Does API trading software require programming skills?

Not necessarily. Cloud SaaS bots run from UI configuration with no code. Open-source options like Freqtrade and Hummingbot need Python; a custom engine needs more. The trade-off is freedom — without code you are limited to the platform's preset grid, DCA and signal templates.

2. Can third-party trading software take my funds?

Under a standard API integration, funds stay in your exchange account and the third party holds a permission-scoped key, not withdrawal rights. The exposure is order authority: a misused key can be used to trade against you. Mitigate by granting minimum permissions, binding an IP whitelist, rotating keys, and not exposing a full balance to one third-party key.

3. How many API keys can one WEEX account create?

Per WEEX API documentation checked 5 August 2026, each user can create up to 10 API key groups, each configurable for Read and/or Trade permissions. Copy-trading keys follow separate rules, with one per approved trader account.

4. What should software do when the order endpoint returns 429?

Stop sending requests and wait out the ban — WEEX spot documentation specifies a 10-second ban. The correct design reads the remaining-weight and remaining-order-count headers and throttles proactively, rather than discovering the limit only after being rejected.

5. Is there a way to test the integration without risking real funds?

Yes. WEEX futures provides demo endpoints under /capi/v3/sim/ for balance, order placement, positions and order history, using the same authentication as production — suitable for validating signing, rate-limit handling and recovery logic.

Risk Warning

Crypto assets are highly volatile. Automating execution does not reduce market risk; it accelerates it, losses included. API trading software carries specific additional risks: a leaked key can allow a third party to trade your account; network failures, process crashes or rate-limit bans can prevent a stop from executing; leveraged futures positions can be liquidated in fast markets, resulting in partial or total loss of principal; third-party software may contain vulnerabilities or operator risk; and backtested performance is not indicative of future results. Use only capital you can afford to lose, bind IP whitelists and scope permissions to the minimum on every key, and validate in a demo environment before deploying live. This article is for information only and is not investment advice.