Why an exchange API returns 403 or 451: blocks and regions
A 403 means the server understood your request and refuses to carry it out. A 451 means access is refused for legal reasons. On crypto exchange APIs, a 403 can be a web firewall, a request limit, an unauthorised key or a regional block, so the code alone does not tell you which. The response body, the exchange's documentation and a comparison from another network usually do. A real restriction applies to you for a reason, so the right response is to find out whether the service is available where you are.
Read the response body first, because it normally names the reason. Binance uses 403 for its web application firewall limit, Bybit uses it for "access too frequent", and many exchanges use 403 or 451 for restricted regions. If an exchange restricts your country, using a tool to hide your location is likely to breach its terms and can put your funds at risk.
What 403 and 451 mean in general
Both are standard HTTP status codes. 403 Forbidden says the server refuses the request and that repeating it without a change will not help. It says nothing about why. 451 Unavailable For Legal Reasons is narrower: the MDN reference describes it as a resource that is not available due to legal reasons, such as a web page for which a legal action has been issued. The code's number is a nod to the novel Fahrenheit 451.
In practice, exchanges use these two codes inconsistently. A 451 is a clear signal, and it is a fair reading that you are in a restricted location. A 403 needs more investigation.
The common causes of a 403 on an exchange API
Each of these looks identical in a log that records only the status code.
- A web application firewall. Binance's documentation says that HTTP 403 is used when the WAF limit has been violated. A firewall may react to a request pattern, an unusual user agent, or a data centre IP range.
- A request rate block. Bybit returns "403, access too frequent" when an IP exceeds its limit, and says to stop and wait for at least 10 minutes.
- A regional restriction. Many exchanges refuse traffic from certain countries. The message usually says so, in text or in a JSON field.
- Key permissions or IP allow-lists. An API key restricted to certain IP addresses, or lacking a required permission, may return 401 or 403. This usually comes with a clear error.
- A wrong domain for your account. Some exchanges separate their users by region.
- A CDN or proxy block. A content delivery network in front of the exchange may refuse the request before it reaches the exchange at all. The body will then be an HTML page and not JSON.
Read the response body
This is the single most useful step, and it is often skipped because libraries throw an exception at the status code before anyone sees the body. Log it.
- JSON with an exchange error code: the exchange's own application answered. Search for the code in its documentation.
- HTML with a CDN's name, a Ray ID, or a security message: a proxy or firewall answered. The exchange's application may never have seen your request.
- A message naming a country or service restriction: a regional block. Read it literally.
- An empty body: check the response headers and try the request from a different network to compare.
We have to solve this problem ourselves. A 403 on its own does not establish a country restriction, so our checks only classify a response as a regional block when the status is 451, or when it is 403 with a body whose text identifies a restriction. These blocks are counted separately from availability and are shown on each exchange's page, because a legal decision is not an outage.
Regional API domains
A regional restriction does not always mean you cannot use a service at all. Some exchanges run separate entities and domains for different places, and your account is tied to one of them. OKX's API documentation is a clear example. It states that you must use the correct domain, depending on where you registered: users registered on app.okx.com in the US and Australia use us.okx.com, and users on my.okx.com in the EU use eea.okx.com, with separate documentation for each. Bybit's documentation also mentions local site hostnames such as api.bybit.kz.
So if a request fails, check that you are using the domain that matches your account's registration. This is a legitimate fix and needs nothing more than following the documentation.
Cloud servers and IP reputation
A program that works on your laptop can fail on a cloud server, even in the same country. Reasons include:
- The server's location. A cloud region in a restricted country will be refused, even if you live elsewhere. Exchanges may look at IP geolocation, not at where you personally are.
- Shared address history. Your new IP may have been used by someone who abused the API, and a firewall may be remembering it.
- Geolocation errors. Databases mapping IPs to countries can be wrong. Exchanges and cloud providers sometimes disagree on a range's location.
- Automated traffic patterns. Some public endpoints sit behind protections aimed at bots. Well-formed requests, sensible rates and the official API hostname all help.
Choose a server location where the exchange actually offers its service. If you are unsure, check its terms and list of restricted countries before you deploy anything. Then run the test below from the server and not from your laptop.
Is the block real? A way to test it
- Make a public request with no key from the affected machine, such as the exchange's server time endpoint, and save the status and body.
- Repeat from a different network in the same country, such as a mobile connection, if you have one available.
- Compare the results with the exchange's own status page and with independent readings such as our exchange pages.
- If only signed requests fail, the problem is your key's permissions, its IP allow-list or the signature rather than a block.
- If the response names a region and the exchange's terms list it, treat this as the final answer.
Be careful about which conclusions you draw. Results from one location describe that route. Our own measurements come from one stated location, so an exchange blocking that location will show up on its page as regional refusals, which says nothing about whether you can use it.
What not to do about a regional block
When an exchange restricts your country, the temptation is to route around it with a VPN or a proxy. We do not recommend it, and not only as a formality. There are practical reasons.
- It probably breaks the terms you agreed to. Most exchanges prohibit misrepresenting your location.
- It puts your funds at risk. Exchanges can restrict or close accounts they find doing this, and getting your money back may require identity checks that reveal the mismatch.
- It may have legal consequences depending on where you live, and these rules are changing in many countries.
- It is fragile. A trading system depending on a proxy has an extra point of failure in the worst moments.
The better path is to look for a licensed service that is available where you live. If you think your region was detected wrongly, contact the exchange through its official support and ask. Note that you are unlikely to get a resolution quickly, and you should keep any money safe in the meantime.
How to handle these codes in code
- Do not blindly retry a 403 or 451. These codes do not generally clear with a quick retry, and repeating them can make a firewall block worse. Treat them differently from a 5xx.
- Log status, headers and body. Trim the body to a safe length, and never log secrets. A short snippet of the body usually identifies the cause.
- Separate the categories in your monitoring. A region refusal and a server failure mean different things. Lumping them together will make your availability numbers meaningless.
- Alert a human on a new 403. It usually marks a change you need to know about, such as a new policy, or a key that has been restricted.
- Back off on Bybit-style frequency blocks. Our rate limit guide covers the response you want in that situation.
Common questions about 403 and 451
Is a 403 from an exchange the same as being banned?
Not necessarily. It can be temporary, as with a rate-based block, or it can come from the location of your server and not from anything you did. A permanent account restriction usually shows up differently, through your account page or through a message from the exchange.
Why do public market data endpoints get blocked as well?
Some exchanges apply regional rules at the network edge, before they look at which endpoint you asked for. That is why a block can appear on a public endpoint needing no key. It is also why our measurements exclude those responses from availability rather than reporting the exchange as down.
What is the difference between 401 and 403?
401 generally means authentication is missing or invalid, so correct credentials could change the result. 403 generally means the server knows who you are, or does not need to, and refuses anyway. Exchanges do not always follow this distinction strictly, so check the body and their error code tables.
Working through a refusal
- Log the full status, headers and response body.
- Check whether the body comes from the exchange or from a proxy.
- Look up the error code in the exchange's documentation.
- Confirm you are using the right domain for your account's region.
- Test a public endpoint from another network.
- Read the exchange's list of restricted locations.
- Stop retrying until you understand the cause.
Related reading: Exchange API rate limits and error 429 · How to check if an exchange is down · How to read API uptime and outage records
Sources
MDN · 451 · Binance · HTTP return codes · Bybit · Rate limit rules · OKX · API documentation · How we measure · About Tickmark
Other guides
What is a funding rate in crypto perpetual futures? A plain explanation
A funding rate is a regular payment between traders holding opposite sides of a perpetual futures contract. It exists because a perpetual contract never expires, so something else has to keep its price close to the underlying asset. When the rate is positive, longs pay shorts; when it is negative, shorts pay longs. The exchange sets the formula but, on the major exchanges, the money moves between traders.
How to compare funding rates across crypto exchanges: 8h vs 4h settlement
You cannot compare two funding rates by looking at the percentages alone. A rate only means something once you know how often it is charged, whether you are long or short, and whether the two readings describe the same contract at the same moment. The same +0.01% costs twice as much per day on a four-hour schedule as on an eight-hour one, and it earns a short exactly what it costs a long.
What does a negative funding rate mean? Who pays, and what it does not tell you
A negative funding rate means traders holding short positions pay traders holding long positions at the next settlement. It usually happens when a perpetual contract trades below its index price, which often reflects heavy shorting or hedging. It does not mean the price is about to fall or about to rise, and it is not free income for longs, because the price can move against them by far more than the payment.
How to convert a funding rate to APR, and why the number can mislead you
To annualise a funding rate, multiply the rate per settlement by the number of settlements in a day, then by 365. A rate of 0.01% every eight hours becomes 0.01% × 3 × 365 = 10.95% a year. This puts contracts on different schedules onto one scale, which makes them comparable. It does not tell you what you will earn or pay over a year, because it assumes today's rate never changes.
Funding rate arbitrage explained: how it works and what eats the profit
Funding rate arbitrage means holding two offsetting positions in the same asset so that price moves roughly cancel, and collecting funding payments on one side. The classic version buys spot and shorts the perpetual. A second version shorts the perpetual on the exchange with the higher rate and goes long on the exchange with the lower rate. It is often described as risk free. It is not. The risks are simply different from the risk of an ordinary directional trade.
Mark price vs last price vs index price: which one liquidates you?
Perpetual futures show three prices that are easy to mix up. The last price is where the most recent trade happened. The index price is an average of spot prices across several exchanges. The mark price is an exchange's estimate of what the contract is fairly worth, and on the major exchanges it is what decides your unrealised profit and whether you are liquidated. Knowing which price does what explains why a position can be liquidated even though the chart never touched your liquidation level.
How much does a market order really cost? Fees, spread and slippage
The fee on an exchange's fee page is only part of what a market order costs. The rest comes from the price you actually receive, which depends on the direction of your trade, your order size and the depth of the order book at that moment. To compare exchanges fairly, measure the average fill price against one reference price, then add your trading fee on top, and be careful not to count the spread twice.
How to estimate slippage from order book depth before you trade
Slippage is the difference between the price you expected and the average price you actually got. You can estimate most of it before placing an order, because the order book shows how much is available at each price. Add up the levels on the side you will consume until they cover your size, calculate the average price, and compare it with the mid price. The estimate is only as good as the snapshot it came from, and books thin out at the moments you are most likely to need them.
Maker and taker fees explained: how to compare crypto exchange trading fees
A maker adds an order to the book that waits to be filled. A taker fills against an order already there. Most exchanges charge takers more than makers, because makers supply the liquidity others trade against. Comparing exchanges by the headline fee alone is misleading: you need to know which side you usually trade on, what tier your volume actually puts you in, and how the fee compares with slippage and funding on the same trade.
How to check if a crypto exchange is down: a step-by-step guide
When an exchange stops working for you, the first question is whether it is down for everyone or only for you. You can usually answer that in a couple of minutes: check the exchange's own status page, check an independent measurement, try a different network, and test the public API directly. Each source sees something different, so one green page does not prove everything is fine, and one failed request does not prove the exchange is down.
Is an exchange really down? How to read API uptime and outage records
Uptime describes the share of successful requests to particular services, over a particular period, from a particular network route. It does not establish whether you can place an order, withdraw funds or trust an exchange with your assets. A figure like 99.9% is useful only if you know what was tested, from where and for how long, so this guide explains how to read those details on our pages and on anyone else's.
What to do when a crypto exchange goes down while you have an open position
If an exchange stops responding while you hold a position, your first job is to find out what is actually broken, the second is to stop making it worse, and the third is to reduce your risk by whatever route still works. Do not keep resending the same order, because earlier attempts may have gone through. Check the mobile app and the API as alternative routes, consider hedging elsewhere if your exposure is large, and record what happened in case you need to raise it later.
Why exchange APIs reject timestamps: clock offset and stale quotes explained
A fast response can contain an old quote. Round-trip latency, clock offset and quote age describe different parts of a request, and mixing them up can make a clock mismatch look like a delayed market feed. This guide explains each one with a worked example, shows how we estimate them, and covers what to do when an exchange API rejects your request because of the time.
Binance error -1021 timestamp: causes and how to fix it
Binance API error -1021 INVALID_TIMESTAMP means the timestamp on your signed request falls outside the window Binance will accept. The message usually reads "Timestamp for this request is outside of the recvWindow" or "was 1000ms ahead of the server's time". In most cases your own clock is the cause, so the fix is to synchronise it, measure the offset against Binance's server time, and handle any remaining network delay properly. A larger recvWindow can hide the problem, but it should not be your first move.
Crypto exchange API rate limits: what error 429 means and how to stay under it
HTTP 429 means you have sent too many requests in a given time, and the server is asking you to slow down. It is not an outage. Each exchange counts requests differently: Binance uses a weight for each endpoint and bans IP addresses that keep going after a 429, Bybit blocks an IP that passes 600 requests in five seconds, and OKX sets limits per endpoint and returns error code 50011. Staying under the limit means reading the response headers, backing off properly and using WebSockets where you can.
Before you open a crypto exchange account: a checklist by country
Before you open an account on a crypto exchange, check four things: whether the exchange is allowed to serve people where you live, whether your country's regulator lists it, whether the site in front of you is the real one, and how the exchange has been running lately. The sign-up form takes ten minutes. Recovering from the wrong choice can take months, and sometimes it is not possible at all. This guide works through each check, using Binance and OKX as worked examples because they are the two exchanges readers ask us about most.
How to open and verify a Binance account: a step-by-step guide
Opening a Binance account takes four steps: register with an email address, a phone number or a Google, Apple or Telegram account; complete identity verification; secure the account; and make a first deposit. Registration takes a few minutes. Binance says verification is usually reviewed within 48 hours. This guide follows each step as Binance's own help pages describe it on 8 November 2026, with screenshots of those pages, and points out the details that most often cause trouble later.
How to open and verify an OKX account: a step-by-step guide
Opening an OKX account takes four steps: register with your country of residence, an email address and a phone number; complete identity verification; secure the account; and make a first deposit. OKX says it reviews verification applications within 24 hours. Which OKX company you end up with depends on where you live, and that decides the address you log in at, the fees you pay and the products you see. This guide follows OKX's own help pages as they stood on 8 November 2026, with screenshots, and flags the choices that are hard to undo. OKX shows some help pages differently by region; we read the versions served at okx.com/en-us, and the rules shown in your own account after you log in are the ones that apply to you.