L3 order book requires API credentials; configure api_key an

Error message

L3 order book requires API credentials; configure api_key and api_secret

What it means

Kraken Spot's L3 order book feed is an authenticated private endpoint, so `subscribe_l3_book` requires API credentials. Without api_key/api_secret in the config the subscription is refused before any network call.

Source

Thrown at crates/adapters/kraken/src/data/spot.rs:308

        }
        let tasks_result = self.finish_tasks().await;
        self.is_connected.store(false, Ordering::Release);
        tasks_result?;
        ws_result?;
        Ok(ws_l3_result?)
    }

    fn subscribe_l3_book(&mut self, cmd: &SubscribeBookDeltas) -> anyhow::Result<()> {
        let instrument_id = cmd.instrument_id;
        let symbol_ustr = instrument_id.symbol.inner();
        let depth = cmd.depth.map_or(1000, |d| d.get() as u32);

        if !matches!(depth, 10 | 100 | 1000) {
            anyhow::bail!("Invalid L3 depth {depth} for Kraken Spot, valid values: 10, 100, 1000");
        }

        if !self.config.has_api_credentials() {
            anyhow::bail!(
                "L3 order book requires API credentials; configure api_key and api_secret"
            );
        }

        let handler_finished = self
            .l3_handler_task
            .as_ref()
            .is_none_or(TaskRef::is_finished);

        if self.ws_l3.is_none() {
            let ws_l3 = KrakenSpotWebSocketClient::l3(
                self.config.clone(),
                self.cancellation_token.clone(),
                self.config
                    .proxy_url
                    .as_ref()
                    .map(|value| value.expose_secret().to_owned()),
            )

View on GitHub (pinned to 18893faf8b)

Solutions

Configure `api_key` and `api_secret` in the Kraken Spot client config
Verify the credentials are Spot credentials (not Futures) and are loaded into the environment
Fall back to L2 (depth snapshots) if authenticated access is not available

Example fix

// before
let config = KrakenDataClientConfig { api_key: None, api_secret: None, ..Default::default() };
// after
let config = KrakenDataClientConfig {
    api_key: Some(read_env("KRAKEN_API_KEY")),
    api_secret: Some(read_env("KRAKEN_API_SECRET")),
    ..Default::default()
};

Defensive patterns

Strategy: validation

Validate before calling

if !config.has_api_credentials() {
    return Err(anyhow::anyhow!("L3 book requires api_key and api_secret"));
}

Type guard

fn has_spot_credentials(cfg: &KrakenDataClientConfig) -> bool {
    cfg.api_key.is_some() && cfg.api_secret.is_some()
}

Try / catch

match client.subscribe_book_deltas(cmd) {
    Err(e) if e.to_string().contains("API credentials") => {
        log::warn!("falling back to L2 book (public feed)");
        client.subscribe_book(cmd.into_l2())?;
    }
    r => r?,
}

Prevention

Provision Spot API keys in env/config before enabling authenticated subscriptions
Check has_api_credentials() before requesting private data
Distinguish Spot vs Futures credentials; they are not interchangeable

When it happens

Trigger: Calling `subscribe_book_deltas` -> `subscribe_l3_book` on a Kraken Spot client whose config has no Spot API credentials (public/market-data-only setup).

Common situations: Running a market-data-only node and adding an L3 book subscription; credentials configured for Futures but not Spot; env vars for keys not set in the deployment.

Related errors

AI-assisted analysis of nautechsystems/nautilus_trader@18893faf8b (2026-09-08). Data as JSON: /api/errors/ff028d99c37731a3. Report an issue: GitHub.