# Deribit vs Gemini Exchange API (slim)

> Gemini Exchange scores 74.6 (BB) to Deribit's 59 (C) for exchange derivatives. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/deribit-vs-gemini-exchange.md (~5,300 tokens) · this version ~3,080 tokens · JSON https://www.anchorterminal.com/compare/deribit-vs-gemini-exchange.json · canonical https://www.anchorterminal.com/compare/deribit-vs-gemini-exchange
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Gemini Exchange API scores 74.6 (BB) on agent readiness against Deribit's 59 (C), and leads in 6 of 7 scored categories. Both do exchange derivatives.

- Deribit: C 59, rank #650 of 1349 · https://www.anchorterminal.com/tools/deribit.min.md
- Gemini Exchange API: BB 74.6, rank #70 of 1349 · https://www.anchorterminal.com/tools/gemini-exchange.min.md
- Deribit, good for An agent trading crypto options, dated futures and perpetuals for an institutional or retail Deribit account, and anyone migrated from Coinbase International Exchange.
- Gemini Exchange API, good for An agent trading spot, perpetuals or prediction markets for a US customer with a role-limited key and a sandbox to rehearse on. Ahead on Reliability, 73 against 45; Agent ergonomics, 79 against 74; Security & auth, 78 against 62; Payments & pricing, 40 against 25; Maintenance & community, 88 against 65; Transparency & trust, 75 against 46. Also Agent-ready, a grade of BB or better; Runs on your own machine.

| Category | Deribit | Gemini Exchange API |
| --- | --- | --- |
| Reliability (16%) | 45 | 73 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 88 | 88 |
| Agent ergonomics (13%) | 74 | 79 |
| Security & auth (14%) | 62 | 78 |
| Payments & pricing (10%) | 25 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 65 | 88 |
| Transparency & trust (7%) | 46 | 75 |

| Fact (where they differ) | Deribit | Gemini Exchange API |
| --- | --- | --- |
| Vendor | Deribit FZE | Gemini Trust Company, LLC |
| Transports |  | stdio |
| Auth | API key | OAuth or key |
| Licence | Proprietary hosted exchange. The API is documented under the Deribit docs with an OpenAPI 3.0 file; no official client library is published | Proprietary hosted API under Gemini's user agreement. The developer-platform repository (MCP server, TypeScript and Go SDKs, samples and skills) is Apache-2.0 |
| Tools exposed | 0 | 87 |
| Read-only variant documented | no | yes |
| Last release | 2026-10-13 | 2026-10-28 |
| Terms last updated | 2026-08-13 | couldn't be read |
| Privacy policy last updated | no document linked | no date given |
| Customer content may train models | not found in the text | yes |
| Terms restrict automated access | yes | couldn't be read |
| Terms restrict benchmarking | not found in the text | couldn't be read |
| Terms or service can change without notice | not found in the text | couldn't be read |
| Arbitration or class-action waiver | not found in the text | couldn't be read |
| Popularity | none | 8 stars, 99 npm/wk |

Why the edge:
- Transparency & trust, Gemini Exchange API +29: Deribit 46 (The editorial half. A closed service whose terms (Deribit FZE membership terms and DRB Panama Inc. terms) sit on a support site that answered 403, with the entity confirmed on VARA's register (12 of 30). The privacy policy was not read, and nothing in the docs states retention (0 of 30). The changelog marks deprecations and the upcoming docs branch previews the next release, but removals such as `public/get_index` on 25 November 2025 carry no notice period (10 of 20). No subprocessor or data-location statement found (0 of 20). Total 22.); Gemini Exchange API 75 (The editorial half. A closed service under a user agreement that names its entities by state, with the MCP server and SDKs open under Apache-2.0 (18 of 30). The privacy policy of 11 May 2026 names entities and processing countries, ties retention to need without numbers and names provider categories only, with no DPA or subprocessor list found (16 of 30). The revision history records removals and type changes with dates, but the upcoming-changes page is "TBD" and no notice period is stated (8 of 20). Processing countries are named (US, Ireland, UK, Malta, Singapore, Australia) and providers by category, with no named subprocessors (12 of 20). 18 + 16 + 8 + 12 = 54.)
- Reliability, Gemini Exchange API +28: Deribit 45 (Read with the hosted lines on the JSON-RPC API. status.deribit.com did not resolve for our reader on 3 November 2026 and Coinbase's status page showed no Deribit component, so no status page is scored, with the unchecked line below (0). No readable history (5). Rate limits are documented with numbers, 50,000 credits per sub-account refilled at 10,000 a second, and matching-engine tiers of 5 to 30 requests a second by 7-day volume (15). Error 10028 ends the session and the errors page says to back off exponentially; 10040 means retry; the 6 May 2026 release added a `nonce` for idempotent orders (15). No SLA found (0). The API is generally available; only Starbase is limited to selected clients (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.); Gemini Exchange API 73 (Read with the hosted lines on the REST API at api.gemini.com. status.gemini.com is a Statuspage site with component history (20). Its Atom feed for 10 September to 3 November 2026 holds 25 entries, mostly scheduled trading and FIX upgrades of 15 to 60 minutes with possible order timeouts, single-network deposit delays, and incorrect perpetual index prices for about 3.5 hours on 15 and 16 October; a 3-hour scheduled eOTC window was planned and outside the core API. Minor only (20). Rate limits with numbers, 120 a minute public and 600 private plus per-endpoint limits (15). 429 is documented but with no Retry-After or backoff guidance, and client order ids are recommended without duplicate rejection, so retries are not safe by contract; the heartbeat cancel is a safety net rather than idempotency (8 of 15). No SLA found (0). Generally available (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.)
- Maintenance & community, Gemini Exchange API +23: Deribit 65 (Read as a closed service. The JSON-RPC changelog's latest production entry is 13 October 2026 and an entry dated 5 November 2026 describes the next release; Deribit's posts of 14 October and 2 November 2026 change fees (30). Entries of 18 August, 15 September and 13 October 2026, three in 90 days (20). A public changelog and a support site; whether support answers wasn't tested and the support site refused our reader (10 of 15). No official SDK and no MCP registry entry (0). The OpenAPI and AsyncAPI files are maintained with the docs (5 of 10). Total 65.); Gemini Exchange API 88 (Read as a closed hosted service with an open repository. The revision history's latest entry is 28 October 2026 and the repository was pushed on 5 October (30). Thirteen dated entries between 2 September and 28 October 2026 (20). The nine open items on the repository are all pull requests with replies, Dependabot included, and the docs name trading@gemini.com for developer support; no public issue tracker was tested (15 of 25). Not in the official MCP registry, but current official SDKs, TypeScript 0.1.1 of 23 September and Go 0.1.0 of 29 August 2026 (15). CI workflows validate and publish both SDKs and the MCP server has tests; dependencies are current (8 of 10). 30 + 20 + 15 + 15 + 8 = 88.)
- Security & auth, Gemini Exchange API +16: Deribit 62 (Keys carry five scopes at read, read_write or none, `ip:ADDR` and `expires` limits, can be disabled, reset and removed by API, and self-generated Ed25519 or RSA keys keep the private half off Deribit. The HTTP `client_credentials` example passes `client_secret` in the query string, a documented option, so 10 off (20 of 30). `trade:read` and `wallet:none` give read-only and no-withdrawal keys and the 5 August 2025 release stopped `account:read` keys reading other keys' secrets; no per-order confirmation and the address allow-list article was unreadable (16 of 20). The API returns no untrusted content (10). `private/list_api_keys`, the transaction log and order history let an operator see what a key did, but no per-key call log was found (8 of 15). A HackerOne bug bounty per the support article title and HackerOne's customer story, neither page read first-hand (insights.deribit.com/bug-bounty answered 403), a VARA licence, and no security.txt on www.deribit.com (8 of 20). Total 62.); Gemini Exchange API 78 (Revocable API keys with one role each (Trader, Fund Manager, Auditor, Administrator), HMAC-SHA384 signing with a nonce, and OAuth 2.0 with scopes, PKCE S256, single-use refresh tokens and RFC 7009 revocation; no IP allow-list documented and no key expiry (28 of 30). Auditor is read-only, a Trader key cannot withdraw, approved withdrawal addresses are a Fund Manager action, and the MCP server refuses funds-moving tools without `confirm: true` (18 of 20). The MCP server wraps every response in untrusted-output markers, strips control and bidi characters and redacts memos, labels and agreement text; the REST docs say nothing on the subject (13 of 15). Order and transfer history are readable, but no per-key audit log or API access log was found (5 of 15). security.txt with a PGP contact and a bug bounty paying $150 to $20,000, scoped to the sandbox hosts; no certification was read and no public advisory process was found (14 of 20). 28 + 18 + 13 + 5 + 14 = 78.)
- Payments & pricing, Gemini Exchange API +15: Deribit 25 (No machine payment protocol (0). The fee schedule is on support.deribit.com, which answered 403; Deribit's own posts give VIP4 to VIP7 taker fees and the 0 bps linear options maker fee, so partial prices are public but the lowest tier is unchecked (5 of 20). Public market data needs no key and the test environment is free, with no card anywhere (20). A person signs up in a browser with identity checks before any key exists (0). Total 25.); Gemini Exchange API 40 (No machine payment protocol (0). The API fee schedule is public per tier without login, 0.6% maker and 1.2% taker at the base tier (20). The API is free to call, public market data needs no key, and the sandbox credits test funds with no card (20). A person must sign up in a browser with identity checks, mint a key or approve an OAuth grant, and production OAuth apps wait for Gemini's review (0). 0 + 20 + 20 + 0 = 40.)
- Agent ergonomics, Gemini Exchange API +5: Deribit 74 (An API, read for response sizing. `public/get_order_book` takes `depth`, `get_instruments` filters by currency and kind, and history methods take `count` and `offset`, though `get_instruments` returns every instrument for a currency and costs 10,000 credits (18 of 25). Count and offset pagination, time ranges on trade and transaction logs, and WebSocket channels with interval and depth options (16 of 20). Numeric error codes with short names, a `wait` value on some errors, and sample code that branches on them (18 of 20). A `nonce` on orders since May 2026 returns the existing order on retry, a `label` lets an agent find its own orders, and 10040 marks the calls safe to retry; no MCP annotations apply (16 of 20). Few required parameters and sensible defaults (limit and good_til_cancelled), but no official SDK in any language, so every caller signs and frames JSON-RPC itself (6 of 15). Total 74.); Gemini Exchange API 79 (Graded on the REST API, with the MCP server noted. Order book depth, trade and candle counts can be limited and symbols filtered; the MCP server lists 87 tools with no toolset or read-only subset switch, so a session that loads it pays for all of them (18 of 25). Timestamps, `limit_trades`, `since` and per-symbol filters on history, pagination on prediction-market lists (16 of 20). Errors carry a reason and message an agent can branch on, such as InsufficientFunds, MarketNotOpen and MissingRole, though some messages only say to retry later (16 of 20). client_order_id is echoed back but not checked for duplicates, cancel-all-session-orders and the heartbeat limit damage; the MCP server publishes readOnlyHint and destructiveHint on every tool and gates destructive ones on `confirm: true` (14 of 20). Few required parameters, sensible defaults, and official TypeScript and Go SDKs (15). 18 + 16 + 16 + 14 + 15 = 79.)