Quick Reference

Configuration your bot server needs

WELLAT_BOT_API_KEY=wlt_bot_…      # public identifier — also identifies the strategy it is bound to
WELLAT_BOT_SECRET_KEY=…           # shown once at creation — keep secret

Endpoints

Base URL: https://bot.mywellat.com

Method	Path	Purpose
POST	`/bot/v1/spot/test`	verify signing — no side effects
POST	`/bot/v1/spot/orders`	place an order signal
POST	`/bot/v1/spot/orders/cancel`	cancel an order group by `collectiveId`
POST	`/bot/v1/spot/strategy/close`	close a bot-managed strategy
GET	`/bot/v1/spot/orders`	list order signals + their `collectiveId`s
GET	`/bot/v1/spot/signals/:signalId`	signal status / result recovery

The signature, in one line

x-bot-signature = hex( HMAC-SHA256( secretKey, timestamp + METHOD + path + rawBody ) )

Integration checklist

2FA enabled (Profile → Security) — Account Setup
API key created; secret stored server-side only
Signing implemented — sign the bytes you send — Authentication
POST /test returns Signature valid; clock skew < a few seconds — Testing
Bot-managed strategy created in the Wellat app and bound to your API key — Strategies
Fresh UUID idempotency-key per trade intent; same key reused on retries — Trading
202 handled as pending (poll or idempotent re-send), never as failure — Lifecycle
429 backoff implemented — Rate Limits