Kraken API Unlocked: running multi-strategy operations on Kraken — subaccounts, API keys, and the two layers of separation that matter

TL;DR

• Most multi-strategy operations need two layers of separation: process isolation (one API key per process) and strategy isolation (subaccounts with their own balances, P&L, and risk surface). Kraken supports both natively.
  
• Multiple API keys solve process problems inside one account: separate nonce sequences, scoped permissions, clean blast radius if a single key is compromised.
  
• Subaccounts isolate each strategy across linked accounts: separate balances, separate margin calculations, separate per-account rate limits, while still consolidating into one volume tier for fees.
  
• Subaccounts on Kraken Derivatives are open to any eligible client (set up via support ticket); on Kraken Spot they are gated to institutional clients via the Kraken institutional team.
  
• Run one API key per process. Most “invalid nonce” errors in production are one key shared across multiple processes, not a clock-skew problem.

Two layers of separation: process isolation vs. strategy isolation

The core architectural question for systematic traders is how to separate strategies, permissions, and balances across accounts and processes. Kraken provides two distinct answers, operating at different layers.

• Multiple API keys isolate processes and permissions within one account. Each key carries its own nonce sequence, can be scoped to specific permissions, and creates clean process boundaries. Balances, volume tier, and per-pair rate limits remain shared across keys.
• Subaccounts isolate what API keys cannot. Each subaccount on Kraken has its own balances, its own P&L, its own API keys, and its own rate limits. Margin is calculated at the subaccount level. A master account links all subaccounts — and crucially, trading volume across linked accounts is consolidated for fee schedule tier purposes.

What each layer isolates

Layer one: API key management for multi-strategy operations

One API key per process

A momentum bot and a market-making bot pointed at the same key will collide on nonces. The most common nonce error in production isn’t clock skew, it’s one key shared across multiple processes, each incrementing the nonce independently and racing each other to the API. Split the key, don’t raise the nonce window.

The same rule applies to every process that is not the primary trading bot: monitoring dashboards, P&L reconcilers, position-flattening scripts, and backtests replaying live data against the REST API each need a dedicated key. When a key throws an error or hits a rate limit, you immediately know which process to investigate.

Minimum permissions per role

Kraken API keys are fully scoped. A read-only dashboard does not need order placement permissions. A reconciliation job pulling trade history does not need withdrawal permissions, ever.

Scope each key to exactly what its process requires and nothing more. The cost is one minute during key creation. 

For the full set of best practices (including permission scopes, key 2FA, expiration, rotation, and per-key controls) see Kraken’s API Key Security guide and How to create an API key documentation.

Layer two: subaccounts on Kraken

Subaccounts deliver two structural advantages for multi-strategy operations:

• Trading volume across linked accounts is grouped for the Fee Schedule Volumes tier.
• Funds move instantly and fee-free between the master account and subaccounts.

The canonical use case is running a market-making book and a directional book in parallel without commingling exposure. Separate mandates, separate volatility profiles, or a hedging book against a directional position; each operates within its own risk surface, preventing one strategy’s drawdown from affecting another’s margin or liquidation threshold.

A master Owner manages each Subaccount User. Each Subaccount User has its own KYC and its own Account, while staying linked to the Owner for transfers and consolidated volume tiers.

How to create a Kraken subaccount (Derivatives and Spot)

Kraken Derivatives is open to any eligible client. Subaccount creation goes through the Kraken support team:

1. Create a new Kraken account for the subaccount and verify it.
2. Unlock Derivatives trading from the subaccount.
3. Submit a Kraken Derivatives support ticket from the master account email address requesting that the accounts be linked.

Once linked, subaccount management (listing, balance retrieval, and transfers between master and subaccounts or between margin accounts sharing a collateral currency) runs through the Futures REST API.

Kraken Spot is institutional-only. The REST API documents a CreateSubaccount endpoint, but availability is gated. CreateSubaccount must be called using an API key from the master account, and the endpoint requires the Withdraw Funds permission on that master key. Spot subaccounts are restricted to institutional clients. Reach this surface through your Kraken relationship manager.

Kraken subaccount operational caveats

• Withdrawals from subaccounts are blocked. Funds have to be moved back to the master account before they can leave Kraken Derivatives. Build that into reconciliation and treasury workflows from the start.
• API keys are generated and controlled separately on each subaccount. The master account does not own subaccount keys.
• API rate limits are managed separately per account.
• Sign-ins are separate for each subaccount.
• Temporary lockouts last about 15 minutes. They trigger after too many failed API calls, invalid nonce errors, or invalid signatures in a short period. A misconfigured key in a tight retry loop can keep a strategy offline for the better part of an hour.

Getting started: API keys and subaccounts

1. Audit current keys. What each one is used for, what permissions it has, whether IP restriction is on.
2. Split keys by process. One key per process, minimum permissions.
3. Apply IP allowlists to every production key.
4. Test in UAT before promoting any new key configuration to production.
5. Decide on subaccounts. Multiple keys are enough if strategies share capital. Subaccounts are needed when strategies need separate capital, P&L, or risk. Derivatives via support ticket, Spot through your Kraken relationship manager.

Create an API key, or for institutional subaccount setups and FIX access, contact the Kraken Institutional team.

FAQ

Who can use subaccounts on Kraken?
Subaccounts on Kraken Derivatives are available to any eligible client and are set up via a support ticket. Subaccounts on Kraken Spot are currently available to institutional clients through the Kraken institutional onboarding team.

What is the difference between API keys and subaccounts on Kraken?
API keys isolate processes and permissions within a single Kraken account. Each key has its own nonce sequence and scoped permissions, but shares balances and rate limits. Subaccounts are separate linked accounts, each with independent balances, margin, rate limits, and API keys, while still consolidating trading volume into one fee tier.

Can I withdraw directly from a Kraken Derivatives subaccount?
No. Funds have to be moved back to the master account before they can leave Kraken Derivatives.

Do subaccounts on Kraken share trading fees across linked accounts?
Yes. Trading volume across all linked subaccounts is consolidated into a single fee schedule volume tier, meaning your combined activity across strategies contributes to lower fee rates.

The post Kraken API Unlocked: running multi-strategy operations on Kraken — subaccounts, API keys, and the two layers of separation that matter appeared first on Kraken Blog.