Bybit V5 API timestamp、recv-window 与 rate-limit 控制清单
本文正文暫以英文原文展示，翻譯版本需完成來源複核後再發布。
已验证事实边界
1. Bybit V5 documentation lists API authentication headers including X-BAPI-API-KEY, X-BAPI-TIMESTAMP, X-BAPI-SIGN and X-BAPI-RECV-WINDOW. 2. Bybit V5 documentation defines a timestamp rule around server time and recv-window. 3. Bybit V5 documentation says the request string differs for GET and POST requests before signing. 4. Bybit V5 rate-limit documentation describes IP limits, WebSocket connection limits and per-UID API limits. 5. Bybit V5 error-code documentation includes request-window, signature, permission, rate-limit and unmatched-IP errors. 6. Public API documentation cannot prove that a private key is safely stored, that an account is regionally eligible, or that future endpoint behavior will remain unchanged.
收起完整分析
决策矩阵
文章表格：可橫向滑動，或聚焦表格區域後使用方向鍵。
| Check | What it means | Practical action | Unknown to keep explicit |
|---|---|---|---|
| Clock sync | timestamp validity depends on server time, recv-window and local clock discipline | record NTP source, drift tolerance and retry policy before private requests | device clock drift and network latency |
| Signature input | GET and POST signing strings differ and serialization mistakes can create false auth failures | test signing with non-secret fixtures and compare request canonicalization | SDK changes and hidden JSON formatting differences |
| Endpoint domain | regional hostnames and restricted IP geographies change where requests should be sent | pin the domain and account region before production routing | future local-site rules and account migration |
| Limit telemetry | rate-limit headers and error codes are runtime evidence, not optional logs | capture non-secret limit status, reset timestamp and retCode for incidents | burst behavior during market stress |
| Stop condition | a bot should pause when timestamp, signature, IP, permission or rate-limit evidence is inconsistent | stop before retry storms or order submission when auth evidence is incomplete | future policy changes and private account restrictions remain unknown |
来源地图
- Bybit API Documentation：Integration Guidance（bybit-v5-guide）
- Bybit API Documentation：Rate Limit Rules（bybit-v5-rate-limit）
- Bybit API Documentation：Error Codes（bybit-v5-error）
- Bybit API Documentation：Get Announcement（bybit-v5-announcement）
控制说明
1. Clock sync
这一项要求读者把公开来源翻译成操作规则。这里的含义是：timestamp validity depends on server time, recv-window and local clock discipline。可执行动作是：record NTP source, drift tolerance and retry policy before private requests。仍然未知的是：device clock drift and network latency。因此本文不会把未知部分包装成收益承诺、牌照承诺、审批保证、安全保证、恢复保证、平台排名或价格暗示。
2. Signature input
这里的含义是：GET and POST signing strings differ and serialization mistakes can create false auth failures。可执行动作是：test signing with non-secret fixtures and compare request canonicalization。仍然未知的是：SDK changes and hidden JSON formatting differences。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
3. Endpoint domain
这里的含义是：regional hostnames and restricted IP geographies change where requests should be sent。可执行动作是：pin the domain and account region before production routing。仍然未知的是：future local-site rules and account migration。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
4. Limit telemetry
这里的含义是：rate-limit headers and error codes are runtime evidence, not optional logs。可执行动作是：capture non-secret limit status, reset timestamp and retCode for incidents。仍然未知的是：burst behavior during market stress。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
5. Stop condition
这里的含义是：a bot should pause when timestamp, signature, IP, permission or rate-limit evidence is inconsistent。可执行动作是：stop before retry storms or order submission when auth evidence is incomplete。仍然未知的是：future policy changes and private account restrictions remain unknown。
操作测试也必须很窄。这就是本文坚持以清单形式呈现的原因。
仍需明确的未知项
- device clock drift and network latency
- SDK changes and hidden JSON formatting differences
- future local-site rules and account migration
- burst behavior during market stress
- future policy changes and private account restrictions remain unknown
实用结论
Bybit V5 API integration 在启用任何交易功能前，应先被当作 timestamp、replay-window 与 throttling control 问题处理。Bybit 文档说明 authenticated headers、timestamp range rules、HMAC/RSA signature construction、区域 endpoint variants、IP restrictions、per-IP connection limits、per-UID endpoint limits，以及 request expiry、bad signature、permission denial、rate limits、unmatched IP 等错误码。实用清单是把 signing、clock sync、recv-window choice、endpoint domain、IP binding、rate-limit headers 与 fail-closed retry behavior 分成独立证据字段。 本文停在证据边界内，帮助读者决定下一步核验什么，而不是把公开文档改写成私人账户、钱包、API key、池子路径、稳定币余额、代币化资产或政策框架在任何未来条件下都能成功的承诺。
相關專題與工具:交易所 API 與行情資料核查