HTX trading API vs Kraken API

HTX trading API 40

No OpenAPI or other machine-readable contract found in the docs or the GitHub accounts (0). No llms.txt on htx.com, and the readable reference is a static page (0). Each endpoint states its purpose and parameters, without when-to-use guidance (12 of 20). Parameter tables carry types, required flags and enums for order types and states (10 of 15). Request and response examples throughout and error-code tables with messages (11 of 15). Versions v1 and v2 are mixed in one reference whose last changelog entry is 24 June 2022, while HTX's newer docs on htx.com couldn't be read (7 of 15). 0 + 0 + 12 + 10 + 11 + 7 = 40.

Kraken API 80

No OpenAPI file was found for the REST API in the docs read; the CLI's agents/tool-catalog.json gives JSON Schema inputs for all 188 commands and the 152 MCP tools (15 of 25). The docs serve Markdown twins such as quickstart.md and the CLI ships llms.txt, AGENTS.md and CONTEXT.md (10). Endpoint pages and guides on order lifecycle, errors and rate limits say what each call does, with less on when not to use one (15 of 20). Enums for order types, time in force and flags, and enums and required fields in the tool catalogue (12 of 15). Python, Node.js and cURL examples, an errors guide and the CLI's error-catalog.json with retry guidance (13 of 15). A changelog of 120 dated entries with deprecations dated (15). 15 + 10 + 15 + 12 + 13 + 15 = 80.

HTX trading API 25

The editorial half. A closed service whose user agreement exists but couldn't be read (script-drawn pages), so the licence clarity is unknown rather than unclear (10 of 30). The privacy policy was not read (0 of 30, unchecked). The testnet shutdown and the 2022 changelog entries are dated, with no deprecation policy (5 of 20). No subprocessor or data-location statement read (0 of 20). 10 + 0 + 5 + 0 = 15.

Kraken API 65

The editorial half. A closed service with clear terms naming regional Payward entities under California law; the CLI is MIT (15 of 30). The privacy notice was not read (5 of 30). The changelog dates deprecations and the terms carry a last-updated date (16 of 20). No subprocessor or data-location statement read (0 of 20). 15 + 5 + 16 + 0 = 36.

HTX trading API 38

Read with the hosted lines. No status page found; status.htx.com does not resolve and nothing on htx.com was readable (0). No readable incident history (5). Rate limits documented per endpoint with numbers, 100 order calls per 2 seconds per UID and so on, with remaining-quota headers (15). No 429 or Retry-After behaviour is documented and the only limit error named is 1006 for conditional orders; a client-order-id unique within 8 hours and an idempotent withdrawal id give safe retries on writes (8 of 15). No SLA found (0). The spot and swap APIs are generally available (10). 0 + 5 + 15 + 8 + 0 + 10 = 38.

Kraken API 67

Read with the hosted lines on the spot API. status.kraken.com is a Statuspage site with REST, WebSocket and FIX components (20). The incidents feed read covers 4 September to 3 November 2026. On 30 October spot and derivatives clients could not connect or submit orders across web, mobile, REST, WebSocket and FIX for 59 minutes 39 seconds, rated minor by Kraken; on 28 October some FIX clients were rejected on reconnection for 1 hour 59 minutes while other interfaces worked; the futures engine was degraded for 3 minutes on 13 October. A whole-exchange order outage 21 seconds short of an hour is read as one major (10 of 30). Numeric limits per key by tier and per pair for the matching engine (15). EAPI:Rate limit exceeded and EService:Throttled with a retry timestamp, a client order id and a validate flag on orders, but no Retry-After header (12 of 15). No SLA (0). Generally available (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.

HTX trading API 51

HMAC-signed keys with Read, Trade and Withdraw permissions, sub-user keys without Withdraw, up to 20 bound IPs, revocation in the account and a 90-day expiry without IP binding. The AccessKeyId and the HMAC signature travel as query parameters; the secret does not, so no deduction for a secret in the URL (24 of 30). Read-only keys and withdraw-free keys exist; no server-side confirmation for orders or withdrawals (14 of 20). The API returns the exchange's own data, no untrusted content (10). No per-call log or key-use history found for the operator (3 of 15). No security.txt, disclosure policy or certification found on the pages that loaded (0 of 20). 24 + 14 + 10 + 3 + 0 = 51.

Kraken API 80

Keys with nine named permissions, optional expiry, IP restriction and nonce window, plus an OAuth sign-in from the CLI (authorisation code with PKCE, public client) that mints a no-withdrawal key expiring within 90 days or a read-only key (30). Read-only and no-withdrawal keys, position limits and pair allowlists in account settings, and MCP approval prompts for 33 dangerous tools (18 of 20). The API returns no untrusted content; the CLI docs warn that the feedback tool uploads a local file without approval (10). Keys and their permissions are listed in settings and ledgers record activity, but no per-call log for the operator was found (6 of 15). A valid security.txt, a bug bounty policy page, SECURITY.md and a secure SDLC workflow in the CLI; certifications not read (16 of 20). 30 + 18 + 10 + 6 + 16 = 80.

HTX trading API 15

No machine payment protocol (0). The fee schedule at htx.com/fee is drawn by script and answered no text, so no price is recorded first-hand (0 of 20, unchecked). Public market data needs no key, card or account; trading needs a verified and funded account. Judgement call (15 of 20). A person must sign up in a browser and pass identity checks (0). 0 + 0 + 15 + 0 = 15.

Kraken API 40

No machine payment protocol (0). Maker and taker fees by tier published without login (20). Public market data, paper trading and the futures demo need no account or card (20). A person signs up, verifies and mints a key or approves the OAuth sign-in (0). 0 + 20 + 20 + 0 = 40.

HTX trading API 57

Read as a closed service. The readable changelog ends on 24 June 2022, but the official contract SDKs were pushed on 21 October 2026 and the spot SDKs in April and July 2026, so the API surface is still being maintained; judgement call (20 of 30). SDK pushes on 30 July, 23 August and 21 October 2026 are commits, not releases (10 of 20). A Telegram group for API support and a support centre, neither tested; GitHub issues not read (8 of 15). Official SDKs in five languages (15). No CI seen, dependencies not checked (4 of 10). 20 + 10 + 8 + 15 + 4 = 57.

Kraken API 81

Read as a closed service with an open-source client. Changelog entry of 27 October 2026 and kraken-cli v0.5.1 on 29 October (30). Fourteen changelog entries since 19 August 2026 and CLI tags on 6 and 7 August and 28 and 29 October (20). A public changelog, api@kraken.com, a status page and a CLI repository merging pull requests at the end of October; issue replies not read (11 of 15). An official Rust SDK pushed in October 2026 and a Go module from January; the MCP server is not in the official registry (12 of 15). The CLI has release and secure SDLC workflows, deny.toml and a pinned toolchain; the SDK's CI not read (8 of 10). 30 + 20 + 11 + 12 + 8 = 81.