KuCoin Exchange Provider
Back Bicrypto's spot markets with KuCoin liquidity — how the provider plugs into the core, what the three-part credential actually is, and which parts of the platform stop working when it is wrong.
The KuCoin Exchange Provider makes KuCoin the source of truth for everything your SPOT wallets touch: the market list, the tickers, the order book, the candles, the deposit addresses your users are shown, and the withdrawals that leave the platform. Your install does not match orders — it forwards them, and mirrors the result into its own database.
Exactly one exchange provider can be active at a time. Enabling KuCoin disables
Binance and XT in the same database transaction, and every route that reaches
for ExchangeManager follows the switch immediately.
Binance and XT authenticate with a key and a secret. KuCoin adds an API passphrase — a string you invent when you create the key on KuCoin, which is never shown to you again afterwards.
Bicrypto's own credential guard only checks that the key and the secret are present. The passphrase is handed to ccxt, and ccxt is what rejects the connection when it is missing. The result is that a half-configured KuCoin install passes the platform's health check and then fails everywhere else. Set it correctly first.
What it requires
| Requirement | Why | If it is missing |
|---|---|---|
| Bicrypto core | The provider is a licensed capability of the core, not a separate service | Nothing to enable |
A licensed KuCoin provider (product 37179816) |
Enabling the provider checks for lic/37179816.lic on disk |
Toggling it on returns 403 with licenseRequired: true |
| A KuCoin account with an API key, secret and passphrase | Every signed call | The spot stack goes dark — see below |
| Outbound HTTPS from the app server to KuCoin | ccxt REST and WebSocket | Timeouts, then a 30-minute cooldown |
| A server IP that KuCoin will serve | KuCoin restricts several regions | HTTP 451 on every call; needs a proxy |
It does not need Ecosystem, ScyllaDB or any blockchain configuration. Those belong to the in-house matching engine, which is a different product solving the opposite problem. The two can run side by side: Ecosystem markets use ECO wallets and your own order book, KuCoin-backed markets use SPOT wallets and KuCoin's. Balances never mix, and neither does the market list.
How the platform reaches KuCoin
There is one shared, process-wide client. ExchangeManager reads the single
exchange row with status = true, takes its name (kucoin), and builds a
ccxt.pro.kucoin instance from three environment variables named after that
value:
APP_KUCOIN_API_KEY="..."
APP_KUCOIN_API_SECRET="..."
APP_KUCOIN_API_PASSPHRASE="..."That instance is cached for the life of the backend process. Consequences worth internalising before you go live:
- Credentials are read once, at first use. Editing
.envdoes nothing until the backend restarts. - The clock matters. Signed requests are timestamped against KuCoin's own
server time, measured with a bracketed
fetchTimeround trip and deliberately biased 500 ms behind. The offset is refreshed in the background every five minutes. A badly wrong system clock still breaks things, but ordinary drift does not. - Failures are sticky. Three consecutive initialisation failures put the
provider into a 30-minute cooldown during which it returns nothing at all,
without retrying. Fixing
.envand restarting is faster than waiting. - Rate limiting is a kill switch. A
RateLimitExceededfrom KuCoin writes a ban marker into Redis underexchange:ban_status. While it is set, every spot path — prices, order reconciliation, deposits, withdrawals, the admin screens — no-ops and reports success. The key carries a TTL so it self-clears, and any ban longer than 24 hours is clamped.
What KuCoin-specific behaviour exists
Most of the integration is generic ccxt. Five things are branched on the
provider name being kucoin, and each of them is a place where KuCoin differs
from the other two providers:
Two accounts, not one. KuCoin splits funds between a Main (funding) account
and a Trade account. After a deposit is credited, the platform transfers the
amount main → trade. Before a withdrawal, it transfers main → trade again,
and refuses to proceed if that transfer does not return an id. Where you park
your float therefore decides whether withdrawals work at all — see
Deposits and withdrawals.
Networks are named after token standards. KuCoin identifies a chain as
ERC20, BEP20, TRC20 rather than ETH, BSC, TRX. The platform maps
between them before asking for a deposit address, and again before submitting a
withdrawal.
Order book depth is quantised. KuCoin accepts depths of 5, 20, 50 or 100 only. A request for any other depth is snapped to the nearest allowed value and trimmed back to the requested size before it reaches the browser.
Tickers are polled, not streamed. For KuCoin the ticker service uses
fetchTickers with retries and stops the batching interval, rather than the
watchTickers stream used elsewhere.
Market imports must be filtered. ccxt loads KuCoin's spot, swap and futures
markets together. Symbols such as BTC/USDT:USDT are dropped on import, because
a single contract symbol in exchange_market makes multi-symbol calls fail
outright with "kucoin symbols must be of the same type" and takes the whole
ticker batch with it.
Where to start
Licence, the three environment variables, enabling the provider, and the verification round trip that proves it works.
Creating the key on KuCoin, what the passphrase is, which permissions each platform feature needs, and IP whitelisting.
Importing from KuCoin, the dry-run plan, enabling markets, precision, and the chart cache.
Main versus Trade, network mapping, memos, and what the withdrawal path actually does with your money.
Every environment variable, setting and admin endpoint this provider touches.
Symptom-first diagnosis, starting with the three ways a passphrase problem presents.