How to Set Up GMX API or Bot Trading

There’s no “get an API key” step for GMX, because there’s no centralized API to request one from. Automated trading means talking directly to GMX’s smart contracts, typically through the official @gmx-io/sdk package.

This guide is part of TradeOnDEX’s GMX how-to series within Perpetual Futures.

Disclosure: TradeOnDEX may earn a commission from links to GMX on this page, at no extra cost to you. Full details at the end of this article.

Why “API access” means something different on a DEX

On a centralized exchange, an API key authenticates your bot against the exchange’s own servers. GMX has no such central server controlling your funds, your bot instead signs transactions directly with your wallet’s private key and submits them to the Arbitrum or Avalanche blockchain, using an RPC endpoint to read and write on-chain data.

This means for you, concretely: “setting up API access” for GMX really means setting up a development environment with your own RPC connection, your own wallet key management, and the SDK that wraps GMX’s contract calls into usable functions.

What you actually need before writing bot logic

1. An RPC endpoint for whichever network you’re trading on (Arbitrum or Avalanche), either your own node or a provider’s endpoint.
2. A wallet with private key access for the bot to sign transactions, this is the single most sensitive piece of the whole setup.
3. The @gmx-io/sdk package, which wraps market data queries and order submission into a usable interface, initialized roughly like:

import { GmxSdk } from "@gmx-io/sdk";

const sdk = new GmxSdk({
  chainId: 42161,
  rpcUrl: "https://arb1.arbitrum.io/rpc",
  oracleUrl: "https://arbitrum-api.gmxinfra.io",
  subsquidUrl: "https://gmx.squids.live/gmx-synthetics-arbitrum:prod/api/graphql",
});

4. From there, sdk.setAccount() attaches your wallet, sdk.markets.getMarketsInfo() pulls current market data, and sdk.orders.long() / sdk.orders.swap() submit order requests through the same keeper-based execution model covered in the limit-orders guide.

A detail worth knowing before you start: synthetic index tokens

Not every market maps cleanly to a token you’d expect. The BTC/USD market, for example, uses a synthetic index token, your code needs to reference the underlying WBTC address specifically rather than assuming a direct BTC token mapping, or your calls to that market will fail or misbehave.

Risk: what changes when your bot has direct wallet access

A bot holding your private key can execute trades with no manual confirmation step in between. This is the entire point of automation, but it also means a logic bug executes immediately and repeatedly rather than being caught at a confirmation screen, test extensively on a small position size before trusting a strategy with meaningful capital.

Storing a private key in code, environment variables, or a script introduces a new attack surface your manual trading never had. Treat key storage for a bot with at least the same seriousness as the self-custody security guide covers for a personal wallet, if not more, since automated systems are common phishing and malware targets.

RPC endpoint reliability directly affects your bot’s ability to execute or even see accurate market data. A free or rate-limited public RPC endpoint can lag or drop requests under load, a strategy relying on time-sensitive execution should account for this rather than assuming instant, guaranteed connectivity.

A GMX-specific bug in a synthetic market or edge case can behave differently from a standard market. As with the BTC/USD synthetic index token detail above, test against the specific markets you intend to trade, not just a generic market, since assumptions that hold on one market don’t automatically hold on all of them.

Consider using a sub-account for bot trading rather than your main wallet. Isolating bot-controlled funds to a dedicated sub-account limits your exposure if the bot’s key is ever compromised, rather than exposing your full account balance to a single automated key.

SDK v1 vs. v2, at a glance

See it for yourself

Before deploying a bot with real capital, run it against a small, isolated sub-account and a modest position size, and watch how it behaves across several market conditions before scaling up. You can review the SDK documentation and GMX’s contracts directly at gmx.io.

Frequently asked questions

Does GMX provide an API key like a centralized exchange?

No, there’s no central API to authenticate against. Bot trading means interacting directly with GMX’s smart contracts, typically via the @gmx-io/sdk package, using your own RPC endpoint and wallet key.

What’s the biggest security difference between manual and bot trading on GMX?

A bot has direct signing access to your wallet with no manual confirmation step, which is efficient but riskier if the key is compromised, using a dedicated sub-account for bot funds limits that exposure.

Do I need to handle every GMX market the same way in code?

Not quite, some markets, like BTC/USD, use a synthetic index token requiring the underlying asset’s address specifically, so test against the actual markets you intend to trade rather than assuming uniform behavior.

Should I use SDK v1 or v2 for a new bot?

SDK v2’s HTTP-backed data access and built-in subaccount helpers make it the more common starting point for new bot projects, though v1’s direct RPC access remains relevant for certain use cases.

Affiliate disclosure

TradeOnDEX may earn a commission if you sign up or trade through a link on this page, at no extra cost to you. GMX’s own affiliate/referral terms are still being confirmed for this site, so links here are direct and untracked for now. This article is educational and is not financial advice; automated trading carries its own additional risks beyond manual trading. See our disclaimer for the full risk warning.