Binance API

Log into Binance and open the API Management page (top-right account menu → API Management). Click 'Create API', choose 'System Generated', give it a label like 'FlutterFlow Dashboard', and complete the 2FA verification. On the permissions screen, enable only 'Enable Reading' — do not enable 'Enable Spot & Margin Trading', 'Enable Withdrawals', or any other permission unless your specific app genuinely requires them. The principle of least privilege limits the damage if the key is ever exposed. After creation you will see the API Key (also called the API Key or `apiKey`) and the Secret Key. Copy the Secret Key immediately — Binance only shows it once. Store the Secret Key in your Firebase/Supabase secrets environment (not in a text file, not in your code). Store the API Key somewhere accessible but not embedded in the app; you will put it in the proxy environment too. You can restrict the API key by IP allowlist (enter your Firebase Cloud Functions or Supabase Edge Function's egress IP) — this prevents the key from being used from any other server even if it leaks. Check the Binance API Management page for instructions on setting IP restrictions.

In FlutterFlow, open the left navigation and click 'API Calls'. Click '+ Add' and select 'Create API Group'. Name it 'Binance Market Data', set the base URL to `https://api.binance.com`, and leave the headers empty for now — public endpoints need no authentication. Click '+ Add API Call' inside the group. For a price ticker call: name it 'Get Ticker Price', set the method to GET, and set the endpoint to `/api/v3/ticker/price`. Click the 'Variables' tab and add a variable named `symbol` with a test value of `BTCUSDT`. Back in the endpoint field, reference it as `/api/v3/ticker/price?symbol={{symbol}}`. Click 'Response & Test', press 'Test API Call', and Binance will return something like `{"symbol": "BTCUSDT", "price": "65000.00"}`. Click 'Generate from Response' to create the JSON paths `$.symbol` and `$.price` automatically. For kline data: add another API Call named 'Get Klines', endpoint `/api/v3/klines?symbol={{symbol}}&interval={{interval}}&limit={{limit}}`, with variables `symbol`, `interval` (e.g. `1h`), and `limit` (e.g. `50`). The kline response is an array of arrays — add JSON paths `$[*][0]` for open time, `$[*][1]` for open, `$[*][2]` for high, `$[*][3]` for low, `$[*][4]` for close. These public calls fire from the device with no secret. Add them to a page's Backend Query or trigger them from an Action Flow.

1{
2  "api_group": "Binance Market Data",
3  "base_url": "https://api.binance.com",
4  "calls": [
5    {
6      "name": "Get Ticker Price",
7      "method": "GET",
8      "endpoint": "/api/v3/ticker/price?symbol={{symbol}}",
9      "variables": [
10        { "name": "symbol", "type": "String", "test_value": "BTCUSDT" }
11      ],
12      "json_paths": {
13        "symbol": "$.symbol",
14        "price": "$.price"
15      }
16    },
17    {
18      "name": "Get 24h Ticker",
19      "method": "GET",
20      "endpoint": "/api/v3/ticker/24hr?symbol={{symbol}}",
21      "variables": [
22        { "name": "symbol", "type": "String", "test_value": "BTCUSDT" }
23      ],
24      "json_paths": {
25        "priceChangePercent": "$.priceChangePercent",
26        "lastPrice": "$.lastPrice",
27        "volume": "$.volume"
28      }
29    }
30  ]
31}

Private Binance endpoints require the query string to be signed with your API secret using HMAC-SHA256. This must happen on a server, not in the Flutter app. Set up a Firebase Cloud Function (Node.js) that receives requests from FlutterFlow, adds the timestamp and signature, and forwards to Binance. In your Firebase project (Blaze plan required for outbound HTTP), create a function named `binanceProxy`. Store your Binance API key in Firebase Functions config or Secret Manager as `BINANCE_API_KEY` and your secret as `BINANCE_API_SECRET`. The function reads these at runtime — they never touch the Flutter app. The function's job: (1) receive the path and query parameters from FlutterFlow, (2) append `timestamp` (current server milliseconds — server time avoids clock-skew errors), (3) compute the HMAC-SHA256 signature over the entire query string, (4) forward the signed request to Binance with the `X-MBX-APIKEY` header, and (5) return the response JSON to FlutterFlow. Deploy with `firebase deploy --only functions` from your local machine. The deployed function URL becomes the base URL of a new FlutterFlow API Group named 'Binance Private'. Your FlutterFlow app never sees the API key or secret — it only calls your proxy URL.

1// Firebase Cloud Function — binanceProxy (index.js)
2const functions = require('firebase-functions');
3const https = require('https');
4const crypto = require('crypto');
5
6const BINANCE_API_KEY = process.env.BINANCE_API_KEY;
7const BINANCE_SECRET = process.env.BINANCE_API_SECRET;
8const BASE_URL = 'https://api.binance.com';
9
10exports.binanceProxy = functions.https.onRequest(async (req, res) => {
11  res.set('Access-Control-Allow-Origin', '*');
12  if (req.method === 'OPTIONS') { res.status(204).send(''); return; }
13
14  const path = req.query.path || '/api/v3/account';
15  const timestamp = Date.now();
16  const params = { ...req.query, timestamp };
17  delete params.path;
18
19  const queryString = Object.keys(params)
20    .map(k => `${k}=${params[k]}`)
21    .join('&');
22  const signature = crypto
23    .createHmac('sha256', BINANCE_SECRET)
24    .update(queryString)
25    .digest('hex');
26
27  const url = `${BASE_URL}${path}?${queryString}&signature=${signature}`;
28
29  const response = await fetch(url, {
30    headers: { 'X-MBX-APIKEY': BINANCE_API_KEY }
31  });
32  const data = await response.json();
33  res.json(data);
34});

Now create a second API Group in FlutterFlow for private (signed) Binance data. Click 'API Calls' → '+ Add' → 'Create API Group'. Name it 'Binance Private Proxy', and set the base URL to your Firebase Cloud Function URL (e.g. `https://us-central1-yourproject.cloudfunctions.net/binanceProxy`). You do not add any authentication headers here — the proxy handles that server-side. Add an API Call named 'Get Account Balances'. Set the method to GET and the endpoint to just a trailing `/` or empty (the proxy URL itself is the endpoint). Add a variable named `path` with a default value of `/api/v3/account`. The proxy reads `?path=` from the query string and forwards to Binance. In the Response & Test tab, paste a sample Binance account response and click 'Generate from Response' to create JSON paths for the balances array: `$.balances[*].asset`, `$.balances[*].free`, `$.balances[*].locked`. Add this API Call to a FlutterFlow page as a Backend Query, filtering out zero-balance assets in a local variable or in the proxy before returning. Bind the asset name and free balance to a List widget — each row shows a coin and its available balance. For trade history: add another API Call named 'Get My Trades' with `?path=/api/v3/myTrades&symbol={{symbol}}`. Pass the symbol from a page variable set by the user tapping a coin in the balance list.

1{
2  "api_group": "Binance Private Proxy",
3  "base_url": "https://us-central1-yourproject.cloudfunctions.net/binanceProxy",
4  "calls": [
5    {
6      "name": "Get Account Balances",
7      "method": "GET",
8      "endpoint": "/?path=/api/v3/account",
9      "json_paths": {
10        "balances": "$.balances",
11        "asset": "$.balances[*].asset",
12        "free": "$.balances[*].free",
13        "locked": "$.balances[*].locked"
14      }
15    },
16    {
17      "name": "Get My Trades",
18      "method": "GET",
19      "endpoint": "/?path=/api/v3/myTrades&symbol={{symbol}}",
20      "variables": [
21        { "name": "symbol", "type": "String", "test_value": "BTCUSDT" }
22      ]
23    }
24  ]
25}

With both API Groups wired up, build the dashboard screen. Create an App State variable named `lastTickerFetchMs` (Integer) and `tickerList` (a list of your Ticker Data Type with fields: symbol String, price String, changePercent String). On the dashboard page, add an Action triggered by the page load: check whether `currentTime - lastTickerFetchMs > 30000` (30 seconds). If true, fire the 'Get Ticker Price' API Call for each symbol in the watchlist (use a loop variable or multiple parallel calls), update `tickerList` in App State, and set `lastTickerFetchMs` to current time. If false, skip the API call and use the cached App State values. Add a Periodic Action (available in FlutterFlow's Action Flow Editor under 'Timer') set to 30 seconds to trigger the same refresh logic while the screen is open. This avoids burning through Binance's ~1,200 request-weight budget on rapid-fire calls. For the balance section, trigger the 'Get Account Balances' proxy call on page load and store the result in a Page State variable. Add a pull-to-refresh gesture to the List widget that re-triggers the balance call. Bind the ticker list to a ListView: symbol Text widget, price Text widget formatted as a number, and changePercent Text widget with conditional styling (green if the value starts without '-', red otherwise). Bind the balance list to a separate ListView with asset and free amount. The dashboard is now live.

Binance returns HTTP 429 when you exceed request-weight limits and HTTP 418 when the IP is temporarily banned for ignoring 429s. Both require a back-off strategy. In your Firebase Cloud Function proxy, wrap the Binance fetch in a try/catch and forward the status code to FlutterFlow rather than swallowing it. In FlutterFlow, add an error handler in the Action Flow after each API Call: check if the response status code is 429 or 418 and display a Snackbar with 'Rate limit reached — please wait a moment before refreshing'. Clock-skew errors appear as HTTP 400 with a body containing `Timestamp for this request is outside the recvWindow` — add a `recvWindow=5000` parameter in the proxy's query string to give a 5-second tolerance window. The proxy uses `Date.now()` (server time) for the timestamp, which avoids device-clock drift entirely. Signature errors appear as HTTP 400 with `Signature for this request is not valid` — these usually mean the query-string parameters were ordered or encoded differently between the proxy's signing step and the forwarded request. Log the exact query string and signature in the proxy during testing to verify they match. For the web build: Binance's API does not allow browser-origin requests (CORS is blocked). All API Calls from FlutterFlow web — even public ones — must go through the proxy. For native mobile builds, public API Calls work directly; only private calls need the proxy.