Setup pain

Binance API 401 and IP allowlist errors

A 401 right after deploy is almost never “the strategy.” It is the key, the IP lock, or the clock. Work the list in order. Do not turn withdraw on to “test.”

Never enable withdrawals to debug auth. A 401 is an auth problem. Withdraw permission cannot fix it and can empty the account if the key leaks.

What 401 is telling you

The exchange did not accept the request as signed by a key it likes from this IP. Spot vs futures mismatch can look similar. Read the JSON body, not only the HTTP code.

• HTTP 401 / error -2014 or -2015: key, secret, or IP restriction.
• Timestamp / recvWindow: VPS clock skew.
• Invalid permissions: you locked the key to a product the bot is not calling.

Check the IP first

curl -s https://api.ipify.org && echo
# that IPv4 must be the only IP on the Binance key allowlist

Rebuilds change the droplet IP. The old allowlist then 401s every call. Update the key to the new IPv4. Do not set “unrestricted” for a minute.

Key and secret

1. Confirm BINANCE_API_KEY and BINANCE_API_SECRET in .env — no quotes, no trailing space.
2. chmod 600 .env
3. systemd EnvironmentFile= must point at that file.
4. If you rotated the key on Binance, the old secret in .env is dead. Replace both.

Clock

timedatectl
sudo timedatectl set-ntp true

Binance rejects signed requests when the VPS clock is too far off. NTP on Ubuntu usually fixes -1021 recvWindow errors that people misread as 401.

Keep reading