How to Integrate Replit with Binance API

Log in to your Binance account and navigate to Account → API Management (or visit https://www.binance.com/en/my/settings/api-management). Click 'Create API' and choose 'System generated' for a standard API key. Give it a descriptive label like 'replit-trading-bot'. After creation, Binance displays your API key and secret key exactly once — copy both values immediately and store them somewhere temporary before adding them to Replit Secrets. The secret key is never shown again; if you lose it, you must delete the key and create a new one. On the API key settings page, configure the permissions appropriate for your use case. For read-only price data and portfolio tracking, enable 'Read Info' only. For placing orders, also enable 'Enable Spot & Margin Trading'. Never enable 'Enable Withdrawals' unless your application genuinely needs to withdraw funds — this permission dramatically increases the risk if your key is compromised. Binance also allows you to restrict API access to specific IP addresses. If your Replit Reserved VM has a stable IP (check via your deployment's console output or an IP echo service), adding it to the IP whitelist provides an important additional security layer. Even if your API key is stolen, it cannot be used from any other IP address.

Open your Replit project. In the left sidebar, click the lock icon 🔒 to open the Secrets pane. Add two secrets using the 'Add a new secret' form: - Key: BINANCE_API_KEY — Value: your Binance API key - Key: BINANCE_API_SECRET — Value: your Binance secret key Click 'Add Secret' after each one. Replit encrypts these values with AES-256 encryption and injects them as environment variables at runtime. They never appear in your file tree, Git history, or version control exports. Replit's Secret Scanner monitors your code for accidentally pasted credentials and will alert you if it detects an API key pattern in your source files. For development, you can use Binance Testnet credentials instead of live credentials. The Binance Spot Testnet at https://testnet.binance.vision allows you to generate separate test API keys that work with paper trading balances. Add these as separate secrets (e.g., BINANCE_TESTNET_KEY and BINANCE_TESTNET_SECRET) and switch between environments by changing a single environment variable rather than modifying code.

Binance's signed endpoints require you to append a 'timestamp' parameter (current Unix time in milliseconds) and a 'signature' parameter (HMAC-SHA256 of the query string using your secret key) to every request. Public endpoints like /api/v3/ticker/price require only the API key in a header, not a signature. The Python example below shows both patterns: fetching current prices (public) and fetching account balances (signed). The sign_request helper function handles timestamp injection and signature computation. Note that the signature must be computed from the full query string — including the timestamp — and appended as a separate parameter after the signature is computed. Error handling is critical for trading applications. Binance returns structured JSON errors with a 'code' field (negative numbers indicate errors) and a 'msg' field with a human-readable description. Always check for these error fields and implement retry logic with exponential backoff for rate limit errors (HTTP 429) and temporary server errors (HTTP 503).

1import os
2import time
3import hmac
4import hashlib
5import requests
6from urllib.parse import urlencode
7
8API_KEY = os.environ["BINANCE_API_KEY"]
9API_SECRET = os.environ["BINANCE_API_SECRET"]
10
11BASE_URL = "https://api.binance.com"
12# For Testnet: BASE_URL = "https://testnet.binance.vision"
13
14HEADERS = {"X-MBX-APIKEY": API_KEY}
15
16
17def sign_params(params: dict) -> dict:
18    """Add timestamp and HMAC-SHA256 signature to a params dict."""
19    params["timestamp"] = int(time.time() * 1000)
20    query_string = urlencode(params)
21    signature = hmac.new(
22        API_SECRET.encode("utf-8"),
23        query_string.encode("utf-8"),
24        hashlib.sha256
25    ).hexdigest()
26    params["signature"] = signature
27    return params
28
29
30def get_price(symbol: str) -> float:
31    """Fetch current price for a trading pair (public endpoint, no signature)."""
32    resp = requests.get(
33        f"{BASE_URL}/api/v3/ticker/price",
34        params={"symbol": symbol},
35        headers=HEADERS
36    )
37    resp.raise_for_status()
38    data = resp.json()
39    if "code" in data:
40        raise ValueError(f"Binance error {data['code']}: {data['msg']}")
41    return float(data["price"])
42
43
44def get_account_balances() -> list:
45    """Fetch non-zero account balances (signed endpoint)."""
46    params = sign_params({"omitZeroBalances": "true"})
47    resp = requests.get(
48        f"{BASE_URL}/api/v3/account",
49        params=params,
50        headers=HEADERS
51    )
52    resp.raise_for_status()
53    data = resp.json()
54    if "code" in data:
55        raise ValueError(f"Binance error {data['code']}: {data['msg']}")
56    return data.get("balances", [])
57
58
59def place_market_order(symbol: str, side: str, quantity: float) -> dict:
60    """Place a market order. side must be 'BUY' or 'SELL'."""
61    params = sign_params({
62        "symbol": symbol,
63        "side": side,
64        "type": "MARKET",
65        "quantity": quantity
66    })
67    resp = requests.post(
68        f"{BASE_URL}/api/v3/order",
69        params=params,
70        headers=HEADERS
71    )
72    resp.raise_for_status()
73    data = resp.json()
74    if "code" in data:
75        raise ValueError(f"Binance error {data['code']}: {data['msg']}")
76    return data
77
78
79if __name__ == "__main__":
80    price = get_price("BTCUSDT")
81    print(f"BTC/USDT: ${price:,.2f}")
82
83    balances = get_account_balances()
84    print("Account balances:")
85    for b in balances:
86        print(f"  {b['asset']}: free={b['free']}, locked={b['locked']}")

The Node.js implementation follows the same pattern: build a query string, append a timestamp, compute the HMAC-SHA256 signature using Node's built-in crypto module (no external dependencies needed for signing), and append the signature to the request. Install axios for HTTP requests with 'npm install axios'. The Express server below exposes three routes: GET /price/:symbol for public price data, GET /balances for signed account data, and POST /order for placing market orders. Each route reads credentials from process.env and never exposes them in responses or logs. For production trading bots, consider adding request queuing to respect Binance's rate limits. The REST API allows 1,200 requests per minute per IP on most endpoints. Exceeding this triggers a temporary IP ban. Implement a simple request counter or use the 'used-weight' response headers Binance returns to track your current usage.

1const express = require('express');
2const axios = require('axios');
3const crypto = require('crypto');
4const { URLSearchParams } = require('url');
5
6const app = express();
7app.use(express.json());
8
9const API_KEY = process.env.BINANCE_API_KEY;
10const API_SECRET = process.env.BINANCE_API_SECRET;
11const BASE_URL = 'https://api.binance.com';
12// For Testnet: const BASE_URL = 'https://testnet.binance.vision';
13
14const HEADERS = { 'X-MBX-APIKEY': API_KEY };
15
16function signParams(params) {
17  params.timestamp = Date.now();
18  const queryString = new URLSearchParams(params).toString();
19  const signature = crypto
20    .createHmac('sha256', API_SECRET)
21    .update(queryString)
22    .digest('hex');
23  params.signature = signature;
24  return params;
25}
26
27// Public: get current price for a symbol
28app.get('/price/:symbol', async (req, res) => {
29  try {
30    const { data } = await axios.get(`${BASE_URL}/api/v3/ticker/price`, {
31      params: { symbol: req.params.symbol.toUpperCase() },
32      headers: HEADERS
33    });
34    if (data.code) return res.status(400).json({ error: data.msg });
35    res.json({ symbol: data.symbol, price: parseFloat(data.price) });
36  } catch (err) {
37    res.status(500).json({ error: err.message });
38  }
39});
40
41// Signed: get non-zero account balances
42app.get('/balances', async (req, res) => {
43  try {
44    const params = signParams({ omitZeroBalances: 'true' });
45    const { data } = await axios.get(`${BASE_URL}/api/v3/account`, {
46      params,
47      headers: HEADERS
48    });
49    if (data.code) return res.status(400).json({ error: data.msg });
50    res.json({ balances: data.balances });
51  } catch (err) {
52    res.status(500).json({ error: err.message });
53  }
54});
55
56// Signed: place a market order
57app.post('/order', async (req, res) => {
58  const { symbol, side, quantity } = req.body;
59  if (!symbol || !side || !quantity) {
60    return res.status(400).json({ error: 'symbol, side, and quantity are required' });
61  }
62  try {
63    const params = signParams({
64      symbol: symbol.toUpperCase(),
65      side: side.toUpperCase(),
66      type: 'MARKET',
67      quantity
68    });
69    const { data } = await axios.post(
70      `${BASE_URL}/api/v3/order`,
71      null,
72      { params, headers: HEADERS }
73    );
74    if (data.code) return res.status(400).json({ error: data.msg });
75    res.json(data);
76  } catch (err) {
77    res.status(500).json({ error: err.message });
78  }
79});
80
81app.listen(3000, '0.0.0.0', () => {
82  console.log('Binance integration server running on port 3000');
83});

Trading bots and real-time price monitors require continuous uptime, so choose Reserved VM deployment rather than Autoscale. Click the Deploy button in the top toolbar, select 'Reserved VM', and choose an appropriate size (the smallest 0.25 vCPU / 256 MB option handles most lightweight bots). Update your .replit file to ensure the correct run command and port binding. For Node.js, set the deployment run command to ['node', 'server.js']. For Python, set it to ['python', 'bot.py']. Confirm the internalPort is 3000 and externalPort is 80 in the [[ports]] section. After deploying, verify that your Replit Secrets are accessible in the production environment — open the console output and confirm your startup log shows the expected API key length (print only the first 4 characters for verification, never the full key). If you whitelisted your Replit IP on Binance, capture the deployment's outbound IP address (fetch https://api.ipify.org from within your deployed app) and verify it matches the IP you whitelisted. For ongoing monitoring, the deployment logs panel shows all stdout and stderr output. Set up structured logging so each API call, order placement, and error includes a timestamp and enough context to reconstruct the sequence of events for post-mortem analysis.

1# .replit deployment config snippet
2# [[ports]]
3# internalPort = 3000
4# externalPort = 80
5#
6# [deployment]
7# run = ["python", "bot.py"]
8# deploymentTarget = "cloudrun"