Bitfinex API vs KuCoin

Bitfinex API 85

Read with the hosted lines on the v2 API at api.bitfinex.com. bitfinex.statuspage.io is a Statuspage site with history back to May 2021 (20). Its feed has no entry between 25 March 2026 and 3 November 2026, so the last 90 days are clean on the record; the feed logs platform-wide outages only (a 14-hour maintenance in March 2026, a 3-hour outage in August 2025), so smaller incidents may go unrecorded. Judgement call (30). Rate limits with numbers, 10 to 90 a minute per IP and the WebSocket connection limits (15). ERR_RATE_LIMIT and the 60-second block are documented, with no Retry-After; orders take a cid but no idempotency key or retry guidance was found (10 of 15). No SLA found (0). Generally available (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

KuCoin 45

Graded with the hosted lines on the API at api.kucoin.com. No status page found (status.kucoin.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per VIP level with per-endpoint weights and IP limits for public endpoints (15). Every response carries gw-ratelimit-limit, gw-ratelimit-remaining and gw-ratelimit-reset, 429000 is documented with a wait rule, and orders take a clientOid the docs recommend as a UUID (15). No SLA (0). The UTA V2 API is the production surface (10). 45.

Bitfinex API 41

Read as a closed service with open clients. The last dated change we could read is bitfinex-api-node 9.1.0 on 18 July 2026, 108 days before the check; the docs changelog stops in October 2024 (10). Not three dated releases in the last 90 days (0). The bitfinexcom organisation pushes often (bfx-report on 3 November 2026) and the clients have issue trackers, but support articles answered 403 and no reply times were read (10 of 25). Official clients current in four languages, Node 9.1.0 of July 2026 and Python 4.0.0 of October 2025; not in the MCP registry (15). The Node client has a dependency history of security fixes (its last GitHub release notes name two) and no CI was read (6 of 10). 10 + 0 + 10 + 15 + 6 = 41.

KuCoin 73

Read as a closed hosted service. The changelog's newest past entry is 2 November 2026 and the universal SDK was pushed 15 September (30). Nine dated changelog entries since 5 August 2026 (20). A Telegram API group (t.me/KuCoin_API) and api@kucoin.com for limit requests, no public issue tracker for the API; the SDK repository's issues were not checked (10 of 25). Official SDKs current in five languages, no MCP registry presence (13 of 15). No package health signal checked (0 of 10). 73.

Bitfinex API 48

No OpenAPI or AsyncAPI file was found on docs.bitfinex.com, in llms.txt or in the client repositories (0). llms.txt and a .md twin of every docs page (10). Each reference page states the endpoint's purpose and fields, and the introduction says when to use api-pub against api, but nothing says when not to use an endpoint (14 of 20). Responses are positional arrays described in field tables, inputs are typed in prose with some enumerations (wallet names, order types) and required fields marked; the withdrawal CODE field is work in progress (7 of 15). Signed-request recipes in five languages, but authenticated errors are documented as 400 with an empty object and there is no error reference (9 of 15). Version v2 in the path and a dated changelog, whose last entry is October 2024 and whose v1 deprecation has no date (8 of 15). 0 + 10 + 14 + 7 + 9 + 8 = 48.

KuCoin 60

No OpenAPI or other machine-readable contract was found; the docs link a Postman workspace and the universal SDK is generated from an internal spec (8 of 25). No llms.txt; the skills hub ships Markdown SKILL.md files with endpoint tables for seven product areas, read-only (6 of 10). One docs page per endpoint with a description, permission and weight, but no when-to-use guidance (12 of 20). Typed parameter tables with enums for type and side and required flags (11 of 15). Request and response examples per endpoint and a unified six-digit error code scheme introduced with V2 (10 of 15). Dated changelog with V1 to V2 versioning (13 of 15). 60.

Bitfinex API 62

Revocable keys with per-scope read and write flags, a permissions endpoint, 2FA and email confirmation at creation, strictly increasing nonces, and IP binding to 20 addresses per the support article's search text (the article answered 403); no key expiry (24 of 30). withdraw and ui_withdraw are separate scopes and read-only keys are possible, but the support text says keys from email-and-password accounts start with every permission enabled and no confirmation step is documented for API withdrawals (14 of 20). The API returns exchange data, not third-party text (10). Login history and an account changelog (audit) endpoint are documented (10 of 15). No security.txt, no readable disclosure policy and no certification page readable (4 of 20). 24 + 14 + 10 + 10 + 4 = 62.

KuCoin 55

API key with a user-set passphrase, HMAC-SHA256 signing, nine permission groups, IP allow-lists required for Withdrawal and FlexTransfers, trading keys without an IP disabled after 30 days of inactivity, revocation on the management page; no OAuth and no expiry on General keys (24 of 30). A General-only key is a true read-only mode and withdrawals are a separate permission; no confirmation step for writes beyond the key scope (12 of 20). Tools return the exchange's own data (10). The API key info endpoint shows permissions and IP lists; no per-call audit log was found (5 of 15). No security.txt, no disclosure policy or bounty on a page we could read, a whistleblower notice on the legal page (4 of 20). 55.

Bitfinex API 40

No machine payment protocol (0). The fees page is public without login (20), though it shows zero maker and taker with no tiers or date. The API is free, public endpoints need no account, and paper trading needs no money (20). A person must sign up in a browser with identity checks and mint the key (0). 0 + 20 + 20 + 0 = 40.

KuCoin 35

No machine payment protocol (0). The spot base fee is stated in support articles without login, the futures base rate and the full tier table sit in images or behind script (15 of 20). Market data needs no key, no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 35.

Bitfinex API 49

The editorial half. A closed service whose Exchange Terms and API Terms of Service loaded only navigation, so the licence terms are unknown; the clients are MIT and Apache-2.0 (8 of 30). The privacy statement loaded only navigation, so retention and data handling are unchecked (0 of 30). The docs say v1 will be deprecated "at some point in the future" with no date, and the Python client's 4.0.0 removed endpoints with a release note (5 of 20). Subprocessors and data locations are in the unread privacy statement (0). 8 + 0 + 5 + 0 = 13.

KuCoin 54

The editorial half. A closed hosted service with terms that are clear on use, liability and law but name no company (12 of 30). The privacy policy gives retention periods by purpose and provider (2 years after closure, 14 months for Firebase, 3 years for Jumio, 5 years for Sumsub) and names 41 services, with no data centre locations (22 of 30). Endpoints are removed and fields deprecated in dated changelog entries with no notice period or policy (8 of 20). Third parties named by service, locations not stated beyond transfers around the globe (10 of 20). 52.