Bitget vs HTX trading API

Bitget 65

The editorial half. A closed hosted service with clear terms naming BTG Technology Holdings Limited; the toolkit is MIT (15 of 30). The privacy notice names the controller and EEA representative, gives 7-year and up to 10-year retention for compliance and litigation, and names recipients by category only (18 of 30). Deprecations and parameter changes carry effective dates (delta mode deprecated 27 August, symbol and category required from 30 September, snapshot changes with demo and live dates) but no written policy (15 of 20). Recipients by category, transfers under Seychelles law with no locations or provider names (5 of 20). 53.

HTX trading API 25

The editorial half. A closed service whose user agreement exists but couldn't be read (script-drawn pages), so the licence clarity is unknown rather than unclear (10 of 30). The privacy policy was not read (0 of 30, unchecked). The testnet shutdown and the 2022 changelog entries are dated, with no deprecation policy (5 of 20). No subprocessor or data-location statement read (0 of 20). 10 + 0 + 5 + 0 = 15.

Bitget 74

The agent SDK ships openapi.yaml with 109 typed UTA v3 operations from which the tools are generated, a machine-readable contract from the vendor's own organisation though not on the docs site (20 of 25). llms.txt in the SDK and MCP repositories; the docs site has none (6 of 10). Intent tools with a discover tool that explains each verb, action and its risk level, and the server's initialize instructions state surface, modules and read-only posture (15 of 20). Typed inputs with enums and required fields from the OpenAPI source (12 of 15). Examples in the quick start and READMEs, a REST error code page in the legacy docs that we did not read in full (9 of 15). Changelog by day with preview notices and effective dates (12 of 15). 74.

HTX trading API 40

No OpenAPI or other machine-readable contract found in the docs or the GitHub accounts (0). No llms.txt on htx.com, and the readable reference is a static page (0). Each endpoint states its purpose and parameters, without when-to-use guidance (12 of 20). Parameter tables carry types, required flags and enums for order types and states (10 of 15). Request and response examples throughout and error-code tables with messages (11 of 15). Versions v1 and v2 are mixed in one reference whose last changelog entry is 24 June 2022, while HTX's newer docs on htx.com couldn't be read (7 of 15). 0 + 0 + 12 + 10 + 11 + 7 = 40.

Bitget 40

No machine payment protocol (0). Base spot and futures rates are stated in a help article without login, the tier table draws by script (20). Market data needs no key, demo trading costs nothing and no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 40.

HTX trading API 15

No machine payment protocol (0). The fee schedule at htx.com/fee is drawn by script and answered no text, so no price is recorded first-hand (0 of 20, unchecked). Public market data needs no key, card or account; trading needs a verified and funded account. Judgement call (15 of 20). A person must sign up in a browser and pass identity checks (0). 0 + 0 + 15 + 0 = 15.

Bitget 78

Read as a hosted service with an open-source toolkit. The UTA changelog's latest launched entry is 30 October 2026 and a preview entry 3 November; the MCP package shipped 3.3.1 on 20 September and agent-skill was pushed 30 October (30). 58 dated changelog entries since 5 August 2026 and six MCP versions since June (20). Issue trackers on the Bitget-AI repositories (11 open on agent_hub) and a support centre; replies were not checked (10 of 25). In the official MCP registry under io.github.Bitget-AI, a GitHub namespace, with official SDKs in five languages (10 of 15). CI workflow with coverage, npm provenance attestations, two runtime dependencies, no install scripts (8 of 10). 78.

HTX trading API 57

Read as a closed service. The readable changelog ends on 24 June 2022, but the official contract SDKs were pushed on 21 October 2026 and the spot SDKs in April and July 2026, so the API surface is still being maintained; judgement call (20 of 30). SDK pushes on 30 July, 23 August and 21 October 2026 are commits, not releases (10 of 20). A Telegram group for API support and a support centre, neither tested; GitHub issues not read (8 of 15). Official SDKs in five languages (15). No CI seen, dependencies not checked (4 of 10). 20 + 10 + 8 + 15 + 4 = 57.

Bitget 83

Read for the API with the MCP server as the agent route. 14 compact tools by default, module filters, a full surface on request and progressive discovery (25). Cursor pagination on CFD order history since 15 October 2026 and limit parameters on lists (15 of 20). Uniform ok or error result shape from the SDK with typed error classes and compact JSON in the text channel (13 of 20). clientOid on orders, dryRun: true on every write, confirm: true gating cancelAll and withdraw, annotations derived from risk level including readOnlyHint, destructiveHint and idempotentHint (18 of 20). Few required fields, official SDKs in five languages plus the TypeScript agent SDK and a CLI (12 of 15). 83.

HTX trading API 69

Graded on the REST API. Responses can be sized with depth types, size and limit parameters on books, candles and history (15 of 25). Paging by from, size and direct on orders and history (14 of 20). Errors return err-code strings with messages, listed in tables (13 of 20). A client-order-id unique within 8 hours and idempotent withdrawal ids make retries safe, with no idempotency header on other writes (14 of 20). Few required parameters and official SDKs in five languages (13 of 15). 15 + 14 + 13 + 14 + 13 = 69.

Bitget 62

API keys with read or read-and-write permission, a passphrase, HMAC-SHA256 or RSA signing, IP binding recommended, 50 keys per UID, revocation on the management page; no OAuth and no separate withdrawal scope in the docs read (22 of 30). --read-only strips write tools at start, --paper-trading routes to demo, and high-risk writes need confirm: true (18 of 20). Tools return the exchange's own data (10). Request and response hooks are forwarded as MCP log notifications; no per-call audit log on Bitget's side was found (6 of 15). security@bitget.com in the toolkit README, no security.txt, Mandiant and SlowMist reports on the September breach, a proof-of-reserves repository, no bounty page read (6 of 20). 62.

HTX trading API 51

HMAC-signed keys with Read, Trade and Withdraw permissions, sub-user keys without Withdraw, up to 20 bound IPs, revocation in the account and a 90-day expiry without IP binding. The AccessKeyId and the HMAC signature travel as query parameters; the secret does not, so no deduction for a secret in the URL (24 of 30). Read-only keys and withdraw-free keys exist; no server-side confirmation for orders or withdrawals (14 of 20). The API returns the exchange's own data, no untrusted content (10). No per-call log or key-use history found for the operator (3 of 15). No security.txt, disclosure policy or certification found on the pages that loaded (0 of 20). 24 + 14 + 10 + 3 + 0 = 51.