dYdX vs HTX trading API

dYdX 83

Read with the hosted lines on the indexer API and the chain endpoints the clients submit to. status.dydx.trade is an Atlassian Statuspage with Frontends, dYdX Chain, Indexer, Order Gateway and Client Libraries components and an RSS history (20). From 1 August to 3 November 2026 the feed has eight items, seven scheduled maintenance windows of 29 minutes to 2 hours (indexer on 9 September, 8 and 15 October, protocol v9.7 on 11 September and v9.8.0 on 12 October, WebSocket compression on 26 and 28 October) and one degraded instant-deposit path through an onboarding partner from 24 to 29 September, outside the trading API. Clean or trivial (30). Rate limits documented with numbers for the indexer, the block limits and the public nodes (15). No 429 shape or Retry-After for the indexer; short-term orders expire by goodTilBlock and client IDs let an agent find an order after a timeout (8 of 15). No SLA (0). Mainnet generally available; the Order Entry Gateway is marked testnet-only (10). 20 + 30 + 15 + 8 + 0 + 10 = 83.

HTX trading API 38

Read with the hosted lines. No status page found; status.htx.com does not resolve and nothing on htx.com was readable (0). No readable incident history (5). Rate limits documented per endpoint with numbers, 100 order calls per 2 seconds per UID and so on, with remaining-quota headers (15). No 429 or Retry-After behaviour is documented and the only limit error named is 1006 for conditional orders; a client-order-id unique within 8 hours and an idempotent withdrawal id give safe retries on writes (8 of 15). No SLA found (0). The spot and swap APIs are generally available (10). 0 + 5 + 15 + 8 + 0 + 10 = 38.

dYdX 60

No machine payment protocol (0). Fees public per tier without login (20). Testnet with a faucet and no card anywhere (20). No signup; an agent with a funded wallet trades, subject to the geographic terms (20). Total 60.

HTX trading API 15

No machine payment protocol (0). The fee schedule at htx.com/fee is drawn by script and answered no text, so no price is recorded first-hand (0 of 20, unchecked). Public market data needs no key, card or account; trading needs a verified and funded account. Judgement call (15 of 20). A person must sign up in a browser and pass identity checks (0). 0 + 0 + 15 + 0 = 15.

dYdX 78

Orders are signed by the account key or by a permissioned key the owner adds as an authenticator, limited by message type, subaccount and market with AllOf or AnyOf, and revoked by remove_authenticator; no shared secret and nothing in a URL (28 of 30). A key can be confined to placing and cancelling orders on one subaccount with withdrawals and transfers excluded, though not to a position or order size, and the interface's default API wallet trades all cross-margin pairs (16 of 20). The API returns no untrusted content (10). Every action is a chain transaction and the indexer lists fills, orders and transfers per subaccount, and authenticators can be listed; no per-key log (10 of 15). A Cantina bug bounty up to $1,000,000 sponsored by dYdX Trading Inc. over the protocol, indexer, web client and SDKs, an Informal Systems audit; no security.txt and no certification (14 of 20). Total 78.

HTX trading API 51

HMAC-signed keys with Read, Trade and Withdraw permissions, sub-user keys without Withdraw, up to 20 bound IPs, revocation in the account and a 90-day expiry without IP binding. The AccessKeyId and the HMAC signature travel as query parameters; the secret does not, so no deduction for a secret in the URL (24 of 30). Read-only keys and withdraw-free keys exist; no server-side confirmation for orders or withdrawals (14 of 20). The API returns the exchange's own data, no untrusted content (10). No per-call log or key-use history found for the operator (3 of 15). No security.txt, disclosure policy or certification found on the pages that loaded (0 of 20). 24 + 14 + 10 + 3 + 0 = 51.

dYdX 83

Read on the clients and the chain. v4-clients was pushed on 29 October 2026 and protocol v9.8.0 shipped on 12 October (30). Protocol v9.7 on 11 September, v9.8.0 on 12 October, v4-client-js tags 3.5.0 and 3.6.0, three or more in 90 days (20). A Discord, a help centre and 36 open issues on v4-clients whose replies couldn't be read (12 of 25). Official SDKs current, the TypeScript client at 3.6.0 and the Python client at 1.1.6 from February 2026 (12 of 15). CI workflows for lint, test, publish and audit, with trusted publishing and provenance on npm (9 of 10). Total 83.

HTX trading API 57

Read as a closed service. The readable changelog ends on 24 June 2022, but the official contract SDKs were pushed on 21 October 2026 and the spot SDKs in April and July 2026, so the API surface is still being maintained; judgement call (20 of 30). SDK pushes on 30 July, 23 August and 21 October 2026 are commits, not releases (10 of 20). A Telegram group for API support and a support centre, neither tested; GitHub issues not read (8 of 15). Official SDKs in five languages (15). No CI seen, dependencies not checked (4 of 10). 20 + 10 + 8 + 15 + 4 = 57.

dYdX 50

The editorial half. Clients AGPL-3.0 with a terms-bound use condition, the chain under a custom licence, two terms documents (dYdX Trading Inc.'s v4 terms of 12 March 2026 and dYdX International Ltd's of 6 June 2025) that are clear about who runs nothing (22 of 30). The privacy policy of 6 June 2025 names dYdX International Ltd, keeps technical data until no longer necessary with no periods, and names no subprocessors; nothing covers the unnamed indexer operator (12 of 30). Protocol upgrades and the WebSocket compression change were posted as dated maintenance notices, deprecated rate-limit fields are marked, but no deprecation policy or notice period is stated (10 of 20). The policy says data may be processed in the EEA and elsewhere, with no subprocessor list (6 of 20). Total 50.

HTX trading API 25

The editorial half. A closed service whose user agreement exists but couldn't be read (script-drawn pages), so the licence clarity is unknown rather than unclear (10 of 30). The privacy policy was not read (0 of 30, unchecked). The testnet shutdown and the 2022 changelog entries are dated, with no deprecation policy (5 of 20). No subprocessor or data-location statement read (0 of 20). 10 + 0 + 5 + 0 = 15.

dYdX 58

No OpenAPI file found for the indexer; the docs publish a types reference of about 200 pages (OrderSide, TimeInForce, OrderStatus and the rest) and the chain's protobuf messages are in the clients (8 of 25). llms.txt and Markdown docs (10). Endpoint pages describe each call and the guides say when to use short-term against long-term orders and the indexer against the node, but descriptions are short (12 of 20). Enums and types on every field in the reference, with pagination and cursor parameters typed (11 of 15). Examples in Python, TypeScript and Rust for each step; errors are described by HTTP status (400 malformed, 404 not found) with no code list (9 of 15). A /v4 path, protocol releases dated on the status page, deprecated rate-limit fields marked, but no API changelog (8 of 15). Total 58.

HTX trading API 40

No OpenAPI or other machine-readable contract found in the docs or the GitHub accounts (0). No llms.txt on htx.com, and the readable reference is a static page (0). Each endpoint states its purpose and parameters, without when-to-use guidance (12 of 20). Parameter tables carry types, required flags and enums for order types and states (10 of 15). Request and response examples throughout and error-code tables with messages (11 of 15). Versions v1 and v2 are mixed in one reference whose last changelog entry is 24 June 2022, while HTX's newer docs on htx.com couldn't be read (7 of 15). 0 + 0 + 12 + 10 + 11 + 7 = 40.