KuCoin Exchange Provider

Back Bicrypto's spot markets with KuCoin liquidity — how the provider plugs into the core, what the three-part credential actually is, and which parts of the platform stop working when it is wrong.

4 min readUpdated 3 August 2026kucoin, exchange, spot, ccxt, provider

The KuCoin Exchange Provider makes KuCoin the source of truth for everything your SPOT wallets touch: the market list, the tickers, the order book, the candles, the deposit addresses your users are shown, and the withdrawals that leave the platform. Your install does not match orders — it forwards them, and mirrors the result into its own database.

Exactly one exchange provider can be active at a time. Enabling KuCoin disables Binance and XT in the same database transaction, and every route that reaches for ExchangeManager follows the switch immediately.

Binance and XT authenticate with a key and a secret. KuCoin adds an API passphrase — a string you invent when you create the key on KuCoin, which is never shown to you again afterwards.

Bicrypto's own credential guard only checks that the key and the secret are present. The passphrase is handed to ccxt, and ccxt is what rejects the connection when it is missing. The result is that a half-configured KuCoin install passes the platform's health check and then fails everywhere else. Set it correctly first.

What it requires

Requirement Why If it is missing
Bicrypto core The provider is a licensed capability of the core, not a separate service Nothing to enable
A licensed KuCoin provider (product 37179816) Enabling the provider checks for lic/37179816.lic on disk Toggling it on returns 403 with licenseRequired: true
A KuCoin account with an API key, secret and passphrase Every signed call The spot stack goes dark — see below
Outbound HTTPS from the app server to KuCoin ccxt REST and WebSocket Timeouts, then a 30-minute cooldown
A server IP that KuCoin will serve KuCoin restricts several regions HTTP 451 on every call; needs a proxy

It does not need Ecosystem, ScyllaDB or any blockchain configuration. Those belong to the in-house matching engine, which is a different product solving the opposite problem. The two can run side by side: Ecosystem markets use ECO wallets and your own order book, KuCoin-backed markets use SPOT wallets and KuCoin's. Balances never mix, and neither does the market list.

How the platform reaches KuCoin

There is one shared, process-wide client. ExchangeManager reads the single exchange row with status = true, takes its name (kucoin), and builds a ccxt.pro.kucoin instance from three environment variables named after that value:

APP_KUCOIN_API_KEY="..."
APP_KUCOIN_API_SECRET="..."
APP_KUCOIN_API_PASSPHRASE="..."

That instance is cached for the life of the backend process. Consequences worth internalising before you go live:

  • Credentials are read once, at first use. Editing .env does nothing until the backend restarts.
  • The clock matters. Signed requests are timestamped against KuCoin's own server time, measured with a bracketed fetchTime round trip and deliberately biased 500 ms behind. The offset is refreshed in the background every five minutes. A badly wrong system clock still breaks things, but ordinary drift does not.
  • Failures are sticky. Three consecutive initialisation failures put the provider into a 30-minute cooldown during which it returns nothing at all, without retrying. Fixing .env and restarting is faster than waiting.
  • Rate limiting is a kill switch. A RateLimitExceeded from KuCoin writes a ban marker into Redis under exchange:ban_status. While it is set, every spot path — prices, order reconciliation, deposits, withdrawals, the admin screens — no-ops and reports success. The key carries a TTL so it self-clears, and any ban longer than 24 hours is clamped.

What KuCoin-specific behaviour exists

Most of the integration is generic ccxt. Five things are branched on the provider name being kucoin, and each of them is a place where KuCoin differs from the other two providers:

Two accounts, not one. KuCoin splits funds between a Main (funding) account and a Trade account. After a deposit is credited, the platform transfers the amount main → trade. Before a withdrawal, it transfers main → trade again, and refuses to proceed if that transfer does not return an id. Where you park your float therefore decides whether withdrawals work at all — see Deposits and withdrawals.

Networks are named after token standards. KuCoin identifies a chain as ERC20, BEP20, TRC20 rather than ETH, BSC, TRX. The platform maps between them before asking for a deposit address, and again before submitting a withdrawal.

Order book depth is quantised. KuCoin accepts depths of 5, 20, 50 or 100 only. A request for any other depth is snapped to the nearest allowed value and trimmed back to the requested size before it reaches the browser.

Tickers are polled, not streamed. For KuCoin the ticker service uses fetchTickers with retries and stops the batching interval, rather than the watchTickers stream used elsewhere.

Market imports must be filtered. ccxt loads KuCoin's spot, swap and futures markets together. Symbols such as BTC/USDT:USDT are dropped on import, because a single contract symbol in exchange_market makes multi-symbol calls fail outright with "kucoin symbols must be of the same type" and takes the whole ticker batch with it.

Where to start

Install

Licence, the three environment variables, enabling the provider, and the verification round trip that proves it works.

API keys and permissions

Creating the key on KuCoin, what the passphrase is, which permissions each platform feature needs, and IP whitelisting.

Currencies and markets

Importing from KuCoin, the dry-run plan, enabling markets, precision, and the chart cache.

Deposits and withdrawals

Main versus Trade, network mapping, memos, and what the withdrawal path actually does with your money.

Reference

Every environment variable, setting and admin endpoint this provider touches.

Troubleshooting

Symptom-first diagnosis, starting with the three ways a passphrase problem presents.