← All articles · 2026-10-18
Why we verify your UID instead of asking for your API key
Many rebate sites ask for an exchange API key. We never do, and here is why that is safer for you and just as accurate for us.
The usual approach, and its problem
Rebate and tracking sites often ask you to paste an exchange API key so they can read your trades. That means trusting a third party with a credential that, depending on the permissions ticked, could place orders or move funds. Even a read-only key reveals your full trading history to someone you have never met.
What an affiliate can see without your key
Bybit gives affiliates an API over their own referral tree. For each referred UID it reports daily trading volume, deposit totals, KYC status and, crucially, the commission the affiliate earned from that user. The affiliate can also ask Bybit whether a specific UID belongs to their tree at all.
That is everything a rebate needs. The commission figure is the amount the rebate is paid from, and it comes from Bybit, not from a calculation on your fills.
How the UID check works here
- You type your Bybit UID.
- We ask Bybit's affiliate API whether that UID was referred by us. The answer comes back in under a second.
- If yes, the account is linked and credits start from the next daily sync.
Why a wrong UID gains nothing
Payouts are internal transfers to the linked UID and to nothing else. If someone typed a UID that is not theirs, the rebate would land in the real owner's Bybit account. There is no address field to redirect money to, so there is nothing to attack. One UID can only be linked once; disputes go to support with the owner's proof.
What you see instead
The affiliate API reports totals per day, not individual trades. Your dashboard shows each day's commission, the tier applied and the credit, which is exactly what the rebate is paid from.
The short version
Your UID proves enough, costs you nothing, and keeps your credentials where they belong: with you.