Authentication & Rate Limits

How authentication and rate limiting work across the Mudrex API. This page covers the public market-data endpoints first, then the authenticated trading API. The two surfaces are independent: market data is unauthenticated and rate-limited per IP; the trading API requires an API key and is rate-limited per key.

Authentication

Market Data (public)

The market-data endpoints - GET /fapi/v1/price/kline, GET /fapi/v1/price/mark-kline, and the WebSocket stream wss://trade.mudrex.com/fapi/v1/price/ws/linear - are public and read-only.

Trading API

To call any private (trading) endpoint under /fapi/v1 you must:

Verify your identity — complete KYC (PAN & Aadhaar) verification and enable two-factor authentication (TOTP) on your Mudrex account.
Generate an API key — create a key in your dashboard and copy the secret. The secret is shown only once; store it securely.

Required headers:

Header	Value	Required
`X-Authentication`	`your_api_secret`	Yes
`Content-Type`	`application/json`	Only for `POST` / `PATCH` / `DELETE`

Example request

curl -X POST "https://trade.mudrex.com/fapi/v1/futures/BTCUSDT/order?is_symbol" \
  -H "Content-Type: application/json" \
  -H "X-Authentication: your-secret-key" \
  -d '{
    "leverage": "5",
    "quantity": "0.001",
    "order_price": "107526",
    "order_type": "LONG",
    "trigger_type": "MARKET",
    "is_takeprofit": true,
    "is_stoploss": true,
    "stoploss_price": "106900",
    "takeprofit_price": "110000",
    "reduce_only": false
  }'

Rate Limits

Market-data and trading limits are tracked independently. Market data is limited per IP; the trading API is limited per API key across three tiers (default, core-trading, wallet).

Market Data - REST

Per-minute call limiting (no weight-based scheme).

Limit	Value	Scope
Requests per minute	300	Per IP

On exceeding the limit, the server responds with HTTP 429 Too Many Requests.

Market Data - WebSocket

Limit	Value	Scope
Max active subscriptions per connection	15	Per connection
New WebSocket connections per minute	10	Per IP

A ticker stream (ticker@5s / ticker@1s) counts as 1 subscription regardless of how many assets it tracks; the ticker asset count is unlimited and does not contribute to the cap.
Exceeding the subscription cap returns application error 429 subscription limit reached.
Exceeding the connection-creation limit returns HTTP 429 Too Many Requests.

Trading API - default endpoints

Applies to all trading endpoints not covered by the core-trading or wallet tiers below.

Duration	Limit
Second	10
Minute	500
Hour	30000

Trading API - core trading endpoints

Applies to: POST /futures/{asset_id}/order, DELETE /futures/orders/{order_id}, POST /futures/positions/{position_id}/add-margin, POST & PATCH /futures/positions/{position_id}/riskorder, POST /futures/positions/{position_id}/reverse, POST /futures/positions/{position_id}/close/partial, POST /futures/positions/{position_id}/close, GET & POST /futures/{asset_id}/leverage.

Duration	Limit
Second	5
Minute	125
Hour	2500
Day	25000

Trading API - wallet endpoints

Applies to: POST /wallet/funds, POST /wallet/futures/transfer, and the INR transfer endpoint POST /futures/transfers/inr.

Duration	Limit
Second	2
Minute	50
Hour	1000

On exceeding any trading limit, the server responds with 429 and a rate-limit error.

The currency you trade in (USDT or INR) does not change which limit applies - limits are per key and per endpoint tier, not per currency.

Error responses

For the full error reference - both market-data (REST + WebSocket) and trading API, including currency-related cases — see the Errors page. In short: REST errors return success: false with an errors array of { code, text }; WebSocket errors return an error object of { code, msg }.