What exchange API terms actually let you do

A crypto exchange will hand you its full order book over an unauthenticated HTTP request, with no account, no key and no rate card. That is a decision about plumbing, not a grant of rights. The document that decides what you may do with the numbers is somewhere else, and it is usually narrower than the endpoint's openness suggests.

How it works

Three separate documents govern an exchange's market data, and they are routinely mistaken for one another.

The key agreement is what you accept when you create an API key. It governs the credential: how you may use it, that it can be revoked at any time without notice, that you may not reverse engineer the software behind it. Binance's API Key Terms are entirely of this kind and say nothing about republishing prices. A developer who reads this one and stops has read the wrong document.

The market-data licence says who owns the trade prints and quotes and what you may do with them once you hold them. This is the document that decides whether the thing you are building can ship. Coinbase binds it explicitly from the developer docs — accessing the Exchange Market Data API is stated there to bind you to the Market Data Terms of Use — and OKX folds its version into section 9 of the API Agreement itself.

The archive licence covers the flat-file dumps: data.binance.vision, OKX's historical-data page, public.bybit.com. It is often the most restrictive of the three, because a bulk download is the form in which data is easiest to resell.

None of the three is accepted by clicking anything. Binance Vision's Dataset Terms bind you, in section 3.2, "upon downloading, caching, querying, or otherwise utilizing" the datasets. OKX closes the obvious escape hatch in the last sentence of section 9.4: "The restrictions in this Section 9.4 apply equally to Market Data accessed through public endpoints as to Market Data accessed through authenticated endpoints."

The money moves in one direction and the data in the other. The exchange generates the prints, publishes them free on endpoints anyone can call, reserves every right in them by contract, and then licenses those rights commercially under a separate agreement whose price it does not publish. Firms that have bought that agreement collect the same data across dozens of venues, normalise it into one schema and sell the result. Their customers are paying for the permission and the normalisation, not for access.

What each document actually says

Quoted from the documents named in the sources below, with the version each was read at. These change; the clause numbers are the stable part.

OKX

The API Agreement last updated 28 July 2026 is the strictest of the four and the clearest. Section 9.1 places every right in the "OKX Materials … including the API Services, Agent Trade Kit, MCP Server, Skills, CLIs, SDKs, documentation, specifications, protocols, software, interfaces, data schemas, and Market Data" with OKX or its licensors. Section 9.4 then grants use of Market Data "solely for your own personal, non-commercial trading and account management purposes" and prohibits four things absent OKX's prior written consent:

• reselling, redistributing, publishing, displaying or otherwise making the data available to any third party — "whether for commercial gain or otherwise", which removes the free-and-public defence;
• using it to "build, operate, or contribute to any competing data product, market data service, financial data aggregator, price feed, or analytics platform";
• using it "to train, fine-tune, or evaluate any machine learning model or AI system that is intended to be commercialized or made available to third parties";
• any use that "competes with or substitutes for OKX's commercial data licensing offerings".

Commercial or institutional scale, the same section says, requires "a separate data licensing agreement". The flat-file archive has its own terms: a revocable, non-exclusive, royalty-free personal-use licence that expressly covers "possession, retention and/or use of such Data for development of your own trading strategy", defines commercial use to include "any re-distribution and/or sub-license of such Data to your end users or business partners", and obliges you to "immediately delete all copies" on revocation.

Binance

Binance is the one case where the operative wording is hard to read in its current form. The API documentation's own terms file is a pointer — "Binance products and services are subject to the Product Terms of Use" — and the page it points at is rendered client-side and served empty to automated clients. The restriction widely quoted from it is nevertheless traceable to the exchange's own page, in section III.1.b:

Without written consent from Binance, the following commercial uses of Binance data are prohibited: 1) Trading services that make use of Binance quotes or market bulletin board information. 2) Data feeding or streaming services that make use of any market data of Binance. 3) Any other websites/apps/services that charge for or otherwise profit from (including through advertising or referral fees) market data obtained from Binance.

That text is present in Internet Archive captures of the Terms of Use from October 2020 through February 2023. Whether the wording survives in the version served today could not be checked, and this page does not claim it does. Read it as the shape of the restriction rather than as a verified current clause, and confirm it against the live page before relying on it. The third limb is the one people trip over: an advertising-funded price widget is named as a commercial use.

The flat-file archive is unambiguous by comparison. The Binance Vision Dataset Terms, version 1.0, last updated 26 August 2026, license the datasets under CC BY-NC-SA 4.0 (section 3.1). Section 3.4 states that "Commercial licensing is strictly excluded under this agreement; any commercial utilization requires a separate, written enterprise data license agreement executed with Binance." Section 4.1 lists the permitted non-commercial uses — academic research, non-monetised open educational projects, "algorithmic historical backtesting for purely personal non-production research", non-commercial open-source data science evaluations. Section 4.2 rules out live proprietary trading execution and signal distribution for compensation; 4.3 rules out licensing, sub-licensing, hosting or commercially exploiting the data "or any derivative real-time or historical data feeds"; 4.4 rules out integration into commercial financial products, hedge fund tools, paid newsletters or commercial trading bot platforms.

The ShareAlike half is the clause that catches people who read only the price. Under section 4.5, a derivative you redistribute must attribute Binance Vision and stay under CC BY-NC-SA 4.0 — so a cleaned, resampled dataset you publish carries the non-commercial restriction onward to everyone who takes it from you.

One scope question is genuinely unresolved in the document. Section 2.1 limits it to data "made available through www.data.binance.vision and associated endpoints", while section 7.1 speaks of "the Binance Vision repository and API base endpoints". Whether that reaches api.binance.com and the market-data-only host is not spelled out either way.

Coinbase

The Market Data Terms of Use, last updated 7 August 2026, grant a "nonexclusive, nontransferable, non-sublicensable, revocable, limited license, solely for you and/or the officers and employees of your entity", for "personal or research purposes", and state that the data "may not be used to build an application intended for use by end users other than for you or your officers/employees".

Absent prior express written consent you may not redistribute, display or disseminate the market data "or any data, charts, analytics, research, or other works based on, referring to, or derived from the Market Data ('Derived Works') — to any third party outside of your organization by electronic means or otherwise". The Derived Works definition is what makes this broader than it first reads: a chart you publish is covered, not only a feed you resell.

Two further prohibitions matter for anything quantitative. The data and Derived Works may not be used to create "indexes, fixings, or other benchmarks", "generic or fair value prices" or valuations of a financial product, nor used as a benchmark — which the document then defines at length. And the version last updated 7 August 2026 adds a clause against using the data to train artificial-intelligence or machine-learning models, drawn wider than OKX's, which is confined to models intended for commercialisation or third-party availability.

Bybit

The API Terms and Conditions last updated 16 January 2026 are drafted around the software but defined over the data. Section 3.1 defines "Service Data" as "any data, or information within the dataset and content that is given by using the API", and the restrictions then run against that definition: section 6.7 forbids repackaging or reselling "the services, or any part thereof, API or Service Data"; 6.9 forbids commercially exploiting the APIs; 6.6 forbids using the API "to monitor the availability, performance, or functionality of any of the API, the Service Data, a service or for any similar benchmarking purposes"; 6.5 forbids replicating Bybit's products or attempting to compete with them.

The ambiguity here is worth naming rather than resolving. Section 2.3 — "Prior to Using an API, you must verify your identity through an API Key" — reads as though the whole document were written for keyed access. Section 1.1 scopes it to "our Application Programming Interface", without qualification, and nothing in the seven pages carves out the unauthenticated endpoints the way OKX deliberately rules them in. A caller with no Bybit account is in an unaddressed position, not a permitted one.

What none of the four addresses

Retention. None of these documents says how long you may keep what you pulled. That is an absence, not a permission and not a prohibition — if a five-year local store of ticks is load-bearing for you, it is a question to put in writing rather than an inference to draw.

A price. OKX names "a separate data licensing agreement", Binance Vision names "a separate, written enterprise data license agreement", Coinbase publishes a contact form. Not one of them publishes a figure, a tier or a rate card for the commercial licence. The cost of doing this properly, directly with an exchange, is not a number anyone outside the negotiation can look up.

Why the paid aggregator layer exists

Coinbase is the only one of the four that publishes the other end of the arrangement, and the list is the most useful single artefact in this area. Its institutional market-data page names eleven authorized redistribution partners: Amberdata, Architect, CCData, Coin Metrics, CoinRoutes, Digital Asset Research, Kaiko, Lukka, NinjaTrader, Polygon.io and Tardis.dev.

That list is the answer to "why would I pay Kaiko when Binance gives me candles for free". These firms are not selling access to numbers that are already public. They have bought, venue by venue, the redistribution right the terms above reserve, and what a subscription buys you is a share of that permission together with the normalisation work — one schema, one clock, one symbology across venues whose own conventions agree about nothing.

Six of the eleven have cards in this catalogue, three of them under a name that has changed since the partner list was written: Amberdata, Coin Metrics (now sold by Talos), Kaiko, Tardis.dev, Polygon.io (which now publishes as Massive) and CCData (now CoinDesk Data). The rename rate in that list is itself worth noticing before you sign a multi-year contract with anyone in it.

The list also sets a ceiling on what a smaller vendor can be selling you. A firm that is not on an exchange's redistributor list and is reselling that exchange's data has either a bilateral agreement it has not advertised or a problem it has not told you about. It is a fair question to ask, and the answer to it is the difference between a supplier and a single point of failure.

What it costs

The raw access costs nothing and that is not the interesting half. OKX, Binance, Coinbase Exchange and Bybit all answer market-data requests with no account and no key; the constraint on the free path is the rate limit, and on all four it is per IP rather than per key, which means it is shared with everyone behind your egress address.

What is priced is the licensed path, and only the redistributor tier of it is published at all:

• Amberdata sells one exchange in one market — spot, futures or options — from a self-serve store at 600 USD a month, or 5,000 USD a year on the annual option, with 20 calls a second and 250,000 a day. It is the cheapest published entry into licensed data we have found.
• Tardis.dev publishes tiers from 350 USD a month for the academic plan, on quarterly or yearly billing only, up to 650 USD a month for all exchanges.
• Massive sells crypto only inside its Currencies plan, from 49 USD a month, alongside forex.
• Kaiko, Coin Metrics above its free community tier, and CoinDesk Data are all quote-only, with no self-serve checkout and no published figure.

Treat every one of those figures as the price of access, not the price of the right to republish. Whether a given plan lets your output leave your organisation is a question about that vendor's own licence, usually answered by a different and more expensive tier, and it is the question to ask before the demo rather than after.

What you can do about it

Work out which document binds you before reading any of them. If you took the data from a REST endpoint, the market-data licence applies. If you downloaded a flat-file dump, the archive terms apply and are probably stricter. If all you did was create a key, the key agreement is the one document that does not answer your question.

Nothing here stops personal or internal use, and that is the threshold that matters. A single trader pulling candles into a notebook, backtesting a strategy and trading their own account is inside the grant in all four documents; OKX names strategy development explicitly. If your output never leaves your organisation and is not itself a product, you can stop reading.

Know the tripwires by name. Each of these is named directly in at least one of the four: a public chart or dashboard; a free API that proxies the exchange's responses; a bot posting prices into a channel other people can read; an advertising-funded or referral-funded price page; an index, fixing, benchmark or "fair value" price; a model you train and then ship. The last two are the newer ones and the easiest to walk into while believing the work is derived enough to be yours.

Treat a derived dataset as still covered. Coinbase's Derived Works definition reaches charts, analytics and research "based on, referring to, or derived from" the data. Binance Vision's ShareAlike clause attaches CC BY-NC-SA 4.0 to anything you redistribute. Resampling, cleaning and aggregating do not launder the licence.

Ask in writing, and ask a narrow question. Written consent is the mechanism all four documents name, which means there is a channel and a decision at the end of it. Cite the clause number, describe the specific use in two sentences, ask whether it needs consent, and keep the reply — it is the only artefact that will be worth anything later. Bybit's public-endpoint ambiguity in particular is not something you can resolve by reading harder.

Price the licensed path before you design around the free one. If the product you are building requires redistribution, the architecture question is settled at the start: you need a licensed source, and the cheapest published entry into one is a few hundred dollars a month for a narrow slice, not the zero you were planning around. Discovering that after the free endpoints are wired in is what makes it expensive.

Ask a prospective vendor which exchanges it is licensed for, venue by venue. Being on one exchange's published redistributor list says nothing about the other forty in the coverage table. The answer is either a list or an evasion, and both are informative.