Margin Trading

Binance Margin-trading Skill

Margin-trading request on Binance using authenticated API endpoints. Requires API key and secret key for certain endpoints. Return the result in JSON format.

Quick Reference

Parameters

Common Parameters

• maxLeverage: Can only adjust 3 , 5 or 10，Example: maxLeverage = 5 or 3 for Cross Margin Classic; maxLeverage=10 for Cross Margin Pro 10x leverage or 20x if compliance allows.
• symbol:
• recvWindow: No more than 60000 (e.g., 5000)
• asset:
• symbol: isolated margin pair
• type: Transfer Type: ROLL_IN, ROLL_OUT
• startTime: Only supports querying data from the past 90 days. (e.g., 1623319461670)
• endTime: (e.g., 1641782889000)
• fromId: If fromId is set, data with id greater than fromId will be returned. Otherwise, the latest data will be returned. (e.g., 1)
• limit: Limit on the number of data records returned per request. Default: 500; Maximum: 1000. (e.g., 500)
• vipLevel: User's current specific margin data will be returned if vipLevel is omitted (e.g., 1)
• coin:
• symbols: Max 5 symbols can be sent; separated by ",". e.g. "BTCUSDT,BNBUSDT,ADAUSDT"
• isolatedSymbol: isolated symbol
• current: Currently querying page. Start from 1. Default:1 (e.g., 1)
• size: Default:10 Max:100 (e.g., 10)
• assets: List of assets, separated by commas, up to 20
• isIsolated: for isolated margin or not, "TRUE", "FALSE"
• asset:
• isIsolated: TRUE for Isolated Margin, FALSE for Cross Margin, Default FALSE (e.g., FALSE)
• amount:
• type: MARGIN,ISOLATED
• txId: tranId in POST /sapi/v1/margin/loan (e.g., 1)
• tier: All margin tier data will be returned if tier is omitted
• listenKey:
• apiName:
• ip: Can be added in batches, separated by commas. Max 30 for an API key
• publicKey: 1. If publicKey is inputted it will create an RSA or Ed25519 key. 2. Need to be encoded to URL-encoded format
• permissionMode: This parameter is only for the Ed25519 API key, and does not effact for other encryption methods. The value can be TRADE (TRADE for all permissions) or READ (READ for USER_DATA, FIX_API_READ_ONLY). The default value is TRADE. (e.g., value)
• apiName:
• ip: Can be added in batches, separated by commas. Max 30 for an API key
• current: Currently querying page. Start from 1. Default:1 (e.g., 1)
• size: Default:10, Max:100 (e.g., 10)
• isIsolated: For isolated margin or not, "TRUE", "FALSE", default "FALSE"
• orderListId: Either orderListId or listClientOrderId must be provided (e.g., 1)
• listClientOrderId: Either orderListId or listClientOrderId must be provided (e.g., 1)
• newClientOrderId: Used to uniquely identify this cancel. Automatically generated by default (e.g., 1)
• orderId: (e.g., 1)
• origClientOrderId: (e.g., 1)
• quantity: (e.g., 1.0)
• limitClientOrderId: A unique Id for the limit order (e.g., 1)
• price: (e.g., 1.0)
• limitIcebergQty: (e.g., 1.0)
• stopClientOrderId: A unique Id for the stop loss/stop loss limit leg (e.g., 1)
• stopPrice: (e.g., 1.0)
• stopLimitPrice: If provided, stopLimitTimeInForce is required. (e.g., 1.0)
• stopIcebergQty: (e.g., 1.0)
• stopLimitTimeInForce: Valid values are GTC/FOK/IOC
• sideEffectType: NO_SIDE_EFFECT, MARGIN_BUY, AUTO_REPAY,AUTO_BORROW_REPAY; default NO_SIDE_EFFECT. More info in FAQ (e.g., NO_SIDE_EFFECT)
• selfTradePreventionMode: The allowed enums is dependent on what is configured on the symbol. The possible supported values are EXPIRE_TAKER, EXPIRE_MAKER, EXPIRE_BOTH, NONE (e.g., NONE)
• autoRepayAtCancel: Only when MARGIN_BUY or AUTO_BORROW_REPAY order takes effect, true means that the debt generated by the order needs to be repay after the order is cancelled. The default is true (e.g., true)
• workingType: Supported values: LIMIT, LIMIT_MAKER
• workingSide: BUY, SELL
• workingClientOrderId: Arbitrary unique ID among open orders for the working order. Automatically generated if not sent. (e.g., 1)
• workingPrice: (e.g., 1.0)
• workingQuantity: (e.g., 1.0)
• workingIcebergQty: This can only be used if workingTimeInForce is GTC. (e.g., 1.0)
• workingTimeInForce: GTC,IOC,FOK
• pendingType: Supported values: Order Types Note that MARKET orders using quoteOrderQty are not supported. (e.g., Order Types)
• pendingSide: BUY, SELL
• pendingClientOrderId: Arbitrary unique ID among open orders for the pending order. Automatically generated if not sent. (e.g., 1)
• pendingPrice: (e.g., 1.0)
• pendingStopPrice: (e.g., 1.0)
• pendingTrailingDelta: (e.g., 1.0)
• pendingQuantity: (e.g., 1.0)
• pendingIcebergQty: This can only be used if pendingTimeInForce is GTC. (e.g., 1.0)
• pendingTimeInForce: GTC,IOC,FOK
• workingIcebergQty: This can only be used if workingTimeInForce is GTC. (e.g., 1.0)
• pendingAboveType: Supported values: LIMIT_MAKER, STOP_LOSS, and STOP_LOSS_LIMIT
• pendingAboveClientOrderId: Arbitrary unique ID among open orders for the pending above order. Automatically generated if not sent. (e.g., 1)
• pendingAbovePrice: (e.g., 1.0)
• pendingAboveStopPrice: (e.g., 1.0)
• pendingAboveTrailingDelta: (e.g., 1.0)
• pendingAboveIcebergQty: This can only be used if pendingAboveTimeInForce is GTC. (e.g., 1.0)
• pendingAboveTimeInForce:
• pendingBelowType: Supported values: LIMIT_MAKER, STOP_LOSS, and STOP_LOSS_LIMIT
• pendingBelowClientOrderId: Arbitrary unique ID among open orders for the pending below order. Automatically generated if not sent. (e.g., 1)
• pendingBelowPrice: (e.g., 1.0)
• pendingBelowStopPrice: (e.g., 1.0)
• pendingBelowTrailingDelta: (e.g., 1.0)
• pendingBelowIcebergQty: This can only be used if pendingBelowTimeInForce is GTC. (e.g., 1.0)
• pendingBelowTimeInForce:
• quantity: (e.g., 1.0)
• quoteOrderQty: (e.g., 1.0)
• price: (e.g., 1.0)
• stopPrice: Used with STOP_LOSS, STOP_LOSS_LIMIT, TAKE_PROFIT, and TAKE_PROFIT_LIMIT orders. (e.g., 1.0)
• icebergQty: Used with LIMIT, STOP_LOSS_LIMIT, and TAKE_PROFIT_LIMIT to create an iceberg order. (e.g., 1.0)
• preventedMatchId: (e.g., 1)
• fromPreventedMatchId: (e.g., 1)
• assetNames: The assets list of small liability exchange， Example: assetNames = BTC,ETH

Enums

• side: BUY | SELL
• newOrderRespType: ACK | RESULT | FULL
• timeInForce: GTC | IOC | FOK

Authentication

For endpoints that require authentication, you will need to provide Binance API credentials. Required credentials:

• apiKey: Your Binance API key (for header)
• secretKey: Your Binance API secret (for signing)

Base URLs:

• Mainnet: https://api.binance.com

Security

Share Credentials

Users can provide Binance API credentials in different ways. The agent will try to retrieve automatically with the two first ways the credentials, but users can also explicitly tell the agent that they have set the credentials or stored them in a .env file, and the agent should re-read that file when they do. The agent can also make http requests with the two first methods without user confirmation.

1. Environment variables

Search for the following specific variables only (never dump the full environment):

Authorized environment variables

• Mainnet: BINANCE_API_KEY and BINANCE_SECRET_KEY

Read and use in a single exec call so the raw key never enters the agent's context:

KEY="$BINANCE_API_KEY"
SECRET="$BINANCE_SECRET_KEY"

response=$(curl -s -X GET "$URL" \
  -H "X-MBX-APIKEY: $KEY" \
  --data-urlencode "param1=value1")

echo "$response"

Environment variables must be set before OpenClaw starts. They are inherited at process startup and cannot be injected into a running instance. If you need to add or update credentials without restarting, use a secrets file (see option 2).

2. Secrets file (.env)

Check ~/.openclaw/secrets.env , ~/.env, or a .env file in the workspace. Read individual keys with grep, never source the full file:

# Try all credential locations in order
API_KEY=$(grep '^BINANCE_API_KEY=' ~/.openclaw/secrets.env 2>/dev/null | cut -d= -f2-)
SECRET_KEY=$(grep '^BINANCE_SECRET_KEY=' ~/.openclaw/secrets.env 2>/dev/null | cut -d= -f2-)

# Fallback: search .env in known directories (KEY=VALUE then raw line format)
for dir in ~/.openclaw ~; do
  [ -n "$API_KEY" ] && break
  env_file="$dir/.env"
  [ -f "$env_file" ] || continue

  # Read first two lines
  line1=$(sed -n '1p' "$env_file")
  line2=$(sed -n '2p' "$env_file")

  # Check if lines contain '=' indicating KEY=VALUE format
  if [[ "$line1" == *=* && "$line2" == *=* ]]; then
    API_KEY=$(grep '^BINANCE_API_KEY=' "$env_file" 2>/dev/null | cut -d= -f2-)
    SECRET_KEY=$(grep '^BINANCE_SECRET_KEY=' "$env_file" 2>/dev/null | cut -d= -f2-)
  else
    # Treat lines as raw values
    API_KEY="$line1"
    SECRET_KEY="$line2"
  fi
done

This file can be updated at any time without restarting OpenClaw, keys are read fresh on each invocation. Users can tell you the variables are now set or stored in a .env file, and you should re-read that file when they do.

3. Inline file

Sending a file where the content is in the following format:

abc123...xyz
secret123...key

• Never run printenv, env, export, or set without a specific variable name
• Never run grep on env files without anchoring to a specific key ('^VARNAME=')
• Never source a secrets file into the shell environment (source .env or . .env)
• Only read credentials explicitly needed for the current task
• Never echo or log raw credentials in output or replies
• Never commit TOOLS.md to version control if it contains real credentials — add it to .gitignore

Never Disclose API Key and Secret

Never disclose the location of the API key and secret file.

Never send the API key and secret to any website other than Mainnet and Testnet.

Never Display Full Secrets

When showing credentials to users:

• API Key: Show first 5 + last 4 characters: su1Qc...8akf
• Secret Key: Always mask, show only last 5: ***...aws1

Example response when asked for credentials: Account: main API Key: su1Qc...8akf Secret: ***...aws1

Listing Accounts

When listing accounts, show names and environment only — never keys: Binance Accounts:

• main (Mainnet)
• futures-keys (Mainnet)

Transactions in Mainnet

When performing transactions in mainnet, always confirm with the user before proceeding by asking them to write "CONFIRM" to proceed.

Binance Accounts

main

• API Key: your_mainnet_api_key
• Secret: your_mainnet_secret

TOOLS.md Structure

## Binance Accounts

### main
- API Key: abc123...xyz
- Secret: secret123...key
- Description: Primary trading account


### futures-keys
- API Key: futures789...def
- Secret: futuressecret...uvw
- Description: Futures trading account

Agent Behavior

1. Credentials requested: Mask secrets (show last 5 chars only)
2. Listing accounts: Show names and environment, never keys
3. Account selection: Ask if ambiguous, default to main
4. When doing a transaction in mainnet, confirm with user before by asking to write "CONFIRM" to proceed
5. New credentials: Prompt for name, environment, signing mode

Adding New Accounts

When user provides new credentials by Inline file or message:

• Ask for account name
• Store in TOOLS.md with masked display confirmation

Signing Requests

For trading endpoints that require a signature:

1. Detect key type first, inspect the secret key format before signing.
2. Build query string with all parameters, including the timestamp (Unix ms).
3. Percent-encode the parameters using UTF-8 according to RFC 3986.
4. Sign query string with secretKey using HMAC SHA256, RSA, or Ed25519 (depending on the account configuration).
5. Append signature to query string.
6. Include X-MBX-APIKEY header.

Otherwise, do not perform steps 4–6.

New Client Order ID

For endpoints that include the newClientOrderId parameter, the value must always start with agent-. If the parameter is not provided, agent- followed by 18 random alphanumeric characters will be generated automatically. If a value is provided, it will be prefixed with agent-

Example: agent-1a2b3c4d5e6f7g8h9i

User Agent Header

Include User-Agent header with the following string: binance-margin-trading/1.1.0 (Skill)

See references/authentication.md for implementation details.