MMashDiv

Installing the Binance provider

Activate the licence, add the API credentials, restart, enable the provider and verify the connection — in the order that avoids a green toggle over a dead connection.

4 min readUpdated 3 August 2026install, licence, env, verify, proxy

There is no package to unzip. The binance row already exists in your database — the core seeder writes all three exchange providers whether you own them or not — so installing this product means four things: proving the licence, putting credentials where the backend can read them, restarting so it reads them, and switching the row on.

The order matters. The enable toggle refuses to work without a licence file, and the credentials are only picked up at process start, so enabling before restarting gives you an active provider with no working connection.

Before you begin

    • A working Bicrypto install — backend, frontend and cron running
    • Your purchase code for Envato item 38650585 and the Envato username it was bought with
    • A Binance account with API access and identity verification completed
    • The public egress IP of the server, not the IP your domain resolves to
    • Shell access to the project root, to edit .env and restart processes
    • Admin panel access with the edit.exchange and create.license permissions

1. Activate the licence

Open Admin → System → Extensions and switch to the Exchanges tab, or go straight to /admin/system/extension?type=exchange. Open the Binance card and activate it with your purchase code.

Activation writes lic/38650585.lic under the project root. That file — not a database column — is the thing the platform checks.

Activates a licence for any product, including exchange providers.
The provider-scoped activation used by the exchange screen. Takes a purchase code and Envato username, and switches every other provider off on success.

exchange.licenseStatus is a cache. Every load of the exchange provider screen checks whether lic/38650585.lic exists on disk and rewrites the column to match. If a restore or a redeploy loses the lic folder, the provider reports itself unlicensed on the next page load even though nothing else changed.

2. Create the Binance API key

Do this before you touch .env. The permissions and the IP allowlist decide which half of the platform works, and getting them wrong produces failures that look like configuration errors rather than permission errors.

Full walkthrough: Binance API keys.

3. Add the credentials

Both variables go in the project root .env. Binance uses a two-part credential — there is no passphrase, unlike KuCoin.

APP_BINANCE_API_KEY="your_api_key"
APP_BINANCE_API_SECRET="your_api_secret"
Binance API key. Read at connection time from the environment; never stored in the database.
Binance API secret.

The backend never contains those literal names. It builds them from the active provider's alias:

APP_${PROVIDER}_API_KEY
APP_${PROVIDER}_API_SECRET
APP_${PROVIDER}_API_PASSPHRASE

So the connector reads APP_BINANCE_API_KEY because the row is named binance. A typo in the variable name is indistinguishable from a missing key: the connector logs that credentials are missing and falls back to a public connection.

There is one more variable, and it is not what most people assume:

First three letters of the exchange alias. Read by the frontend only — the TradingView chart component uses it to pick the symbol prefix, and the market-data WebSocket service uses it to pick the order-book depth ladder the browser requests. Zero backend readers — it does not select the trading connection, and setting it wrong does not break trading. Requires a frontend rebuild.

4. Restart the backend

.env is read once, at process start. The connector also caches one live Binance instance per provider name for the lifetime of the process, so editing credentials without a restart changes nothing at all.

pm2 restart backend cron

Restart cron as well. The currency price job, the deposit verifier and the withdrawal reconciler all build their own connections in that process.

5. Enable the provider

Back on Admin → System → Extensions → Exchanges, toggle Binance on.

Enables or disables a provider. Enabling one runs a transaction that sets every other provider inactive.

Two behaviours to expect:

  • Without the licence file the call returns 403 with licenseRequired: true and the provider stays off. That check reads the disk, so it is immune to a stale database column.
  • Enabling Binance disables KuCoin and XT in the same transaction. If you are migrating between providers, the switch is atomic but the market and currency tables are not — see Currencies and markets.

6. Verify the connection

Open Admin → Finance → Exchange Providers (/admin/finance/exchange) and press Verify Credentials.

Builds a throwaway connection with the saved credentials, loads markets, fetches the account balance and closes. Never on the audit trail — it reads, it does not change anything.

The check does three things in sequence, and each one can fail differently:

  1. Synchronise the clock — it brackets a fetchTime call to measure drift against Binance's clock, then signs from just behind the server. A failure here does not stop the check; it falls back to signing a full second behind.

  2. Load markets — this is the first real request. A blocked region answers HTTP 451 and the screen tells you to configure a proxy.

  3. Fetch the account balance — the only step that proves the key and secret are valid and that the request came from an allowlisted IP.

A green result means reading works. It does not prove that withdrawals will: the withdrawal permission is never exercised until the first real payout.

7. If your server's region is blocked

Binance refuses connections from some regions with HTTP 451, and the verify screen recognises it: "Your server's location is blocked by this exchange."

The provider supports an outbound proxy, configured per provider row in the Settings tab of the exchange screen. http://, https://, socks4:// and socks5:// are all accepted, with optional credentials in the URL.

Opens a credential-less connection through the supplied proxy and calls fetchTime. Test before saving — the test uses its own connection and cannot disturb the running site.
Saves the proxy URL on the provider row and evicts the cached connection so the next request rebuilds through the proxy.

Two consequences worth planning for. The proxy's IP — not your server's — is what reaches Binance, so that is the address to put on the key's allowlist. And any credentials embedded in the proxy URL are masked before the row is returned to the browser, so the field you see is not the value that is stored.

Without a proxy the connector forces IPv4 on its outbound agent. That is deliberate: exchange IP allowlists are IPv4, and a dual-stack box that happens to prefer IPv6 presents an address that was never allowlisted.

What is still missing

An enabled, verified provider has no markets. Nothing is tradable until you import currencies and markets and then enable individual pairs.

  1. Import spot currencies, then markets
  2. Enable the pairs you actually want to list
  3. Understand the deposit and withdrawal path before you take real money