Skip to main content
This guide takes you from no account to working Bitnob Business API credentials: register, complete your profile, then create a CLIENT_ID and CLIENT_SECRET pair and confirm it works.
Building on Bitnob Enterprise instead? See Set up your Bitnob Enterprise account.

​
Create your account

1

Register

Go to accounts.bitnob.com and enter a valid email address.
2

Confirm your email

Enter the confirmation code we send you.
3

Set a password

Use at least 12 characters, with letters, numbers, and symbols.
4

Sign in to the dashboard

Go to app.bitnob.com. The dashboard holds your API keys, balances, transactions, and webhook logs.
Bitnob account setup process
Invite your colleagues from account settings before you start building. Shared access avoids credential sharing later.

​
Complete your profile

Open the Profile section and add:
  • Your company or project name.
  • A contact phone number and a mailing address. We use both for invoices and notifications.

​
Submit compliance documents

Sandbox works without verification, under default limits. Production does not. To unlock production and raise your limits, open Identity & Compliance and submit:
  • Your business registration documents.
  • Identity documents for the account holders.
  • Your settlement bank account details.
Review usually takes 24 to 48 hours. We email you the result.

​
Create Bitnob Business API credentials

Your credentials are a pair: a CLIENT_ID that identifies you, and a CLIENT_SECRET that signs your requests.
1

Open the API keys page

In the dashboard, select Settings > API Keys.
2

Create a key

Select Create Key and complete the form.
3

Copy both values now

We show the secret once. Copy it before you close the dialog.
4

Repeat for the other environment

Create a separate key for sandbox and for production.
We cannot recover a lost secret. If you lose one, revoke the key and create a new one.

​
How sandbox and production differ

Both environments use the same base URL, https://api.bitnob.com. Your CLIENT_ID is the same in both. Only the CLIENT_SECRET differs. The secret you sign with selects the environment. There is no environment header and no separate host.
A production secret in a test job moves real money. Keep the two secrets in separate configuration, and never load both into the same process.
Sandbox data resets from time to time. Do not use it for records you need to keep.

​
Store your credentials

Keep credentials out of source control and out of client applications.
In production, read them from a secret manager rather than a file. API keys and credential security covers storage, rotation, and leak response.

​
Verify your Business API credentials

Call /api/whoami. It returns your authenticated account details and nothing else, so it is safe to call at any time.
A 200 with your company details confirms that your credentials and your signing are correct. A 401 means the signature, the timestamp, or the client id is wrong. The Quickstart shows a working signing script and lists the common causes.
To sign this request from application code, copy a signing helper for Node.js, Go, or Python from Authentication.