The Bitvavo API explained for non-programmers

When I decided to build a trading bot with no developer background at all, I immediately ran into a jungle of jargon. APIs, REST endpoints, webhook payloads. For someone who spent 23 years in banking, it still felt like a foreign language. Still, it turned out to be less complicated than I expected, as long as you understand what an exchange API actually does and why some platforms suit your situation better than others.

What is an exchange API, really?

An API — Application Programming Interface — is simply an intermediary that lets your software talk to a crypto exchange. Instead of manually logging in, clicking buttons, and placing orders, your bot sends commands through that API: "Buy 0.01 BTC at market price," "Fetch my current balance," "Cancel that open order." The exchange understands those commands, executes them, and sends back a confirmation. That's how a bot can trade 24 hours a day, seven days a week, without you having to stay awake.

All the major exchanges — Binance, Kraken, Coinbase, Bitvavo — offer an API like this. The difference lies in the documentation, the speed, the costs, and above all the security of how you configure that access. That last point was the deciding factor for me.

Why I chose Bitvavo over the alternatives

My situation when I chose it: I was living in Vietnam, but I'm Dutch. I wanted to trade in euros, not USD or USDT, because that saves on conversion costs and bookkeeping. Bitvavo is a Dutch exchange, regulated by De Nederlandsche Bank, and works directly with SEPA transfers. That gave me more confidence than a platform without a European license.

On top of that, the Bitvavo API documentation is just plain understandable. No cryptic jargon, no unclear rate limits that suddenly lock you out of your account. The way in is to start small: see how orders work, and learn to read the error messages you get back. For someone with no programming background, that's worth its weight in gold.

The difference between read-only and trade-only API keys

This is where it gets important. When you create an API key, you can assign permissions: read-only (only fetching balance and order history), trade (placing and canceling orders), and withdraw (moving money to an external address). That last option — withdraw — I have never turned on. Why? Because if an attacker ever gets access to my bot or my VPS, they could place orders, but they could never send my euros or bitcoin to their own wallet.

My bot runs on Replit (the AI agent wrote the code), and so does its dashboard. That environment is reasonably secure, but I'm not going to risk one bug in the code or one leaked environment variable leading to a cleaned-out exchange account. Trade-only keys are the standard I recommend to everyone.

How my bot actually runs in practice

Every minute, the bot fetches the current BTC/EUR price through the API, compares it with my moving averages, and decides whether an order needs to be placed. If it does, it sends a POST request to Bitvavo's /order endpoint with parameters like market, side (buy/sell), orderType (market/limit), and amount. The exchange responds with an orderId, which I store in my database. Later, I check whether the order was executed and update my position.

No magic, no black box. Just a matter of fetching data, applying logic, and giving instructions. Replit's AI agent wrote the Python code; I told it what I wanted. The Bitvavo API made it possible to turn that plan into real trades, without me ever having to open a browser myself. That gives me time back for my family — and that was the goal from day one.

Disclaimer: this article shares my personal experience and is not financial advice. Crypto and traded products are risky — prices can fall hard, and a system that worked in the past is no guarantee for the future. Only trade with money you can afford to lose.